PHP: The latest news in the PHP world

Weekly help thread

2026-09-07T06:00:05+00:00

Hey there!

This subreddit isn't meant for help threads, though there's one exception to the rule: in this thread you can ask anything you want PHP related, someone will probably be able to help you out!

submitted by /u/brendt_gd
[link] [comments]

Pitch Your Project 🐘

2026-08-19T08:00:12+00:00

In this monthly thread you can share whatever code or projects you're working on, ask for reviews, get people's input and general thoughts, … anything goes as long as it's PHP related.

Let's make this a place where people are encouraged to share their work, and where we can learn from each other 😁

Link to the previous edition: /u/brendt_gd should provide a link

submitted by /u/brendt_gd
[link] [comments]

When Static Analyzers Teach You the Wrong Way: The Dogma of Variance and the Pursuit of Working QA

2026-09-09T08:09:38+00:00

submitted by /u/rc0604
[link] [comments]

php-radser: finally a library for building a RADIUS server in PHP, on ReactPHP

2026-09-08T20:00:58+00:00

php had radius_* functions in a PECL package (that i think is no longer updated) but did not have any tool for the server side of RADIUS protocol. so this weekend i made a small package for that.

currently only supporting RFC 2865, RFC 2866, RFC 3576/5176 and Mikrotik attributes (i use mikrotik for my own work); currently no EAP, no 802.1X, no Message-Authenticator and no TLV.

it's my first time publishing a php package so i really wanna hear your opinion on this.

submitted by /u/shinya_dono
[link] [comments]

I built a Laravel package to replay Stripe billing lifecycles offline

2026-09-08T12:24:00+00:00

I built Cashier Dunning because testing failed-payment flows in Laravel is surprisingly difficult.

It records a real Stripe billing lifecycle once and replays it offline through your application's actual webhook route, including signature verification and real listeners.

It can replay trial expiration, failed payments, retries, cancellation and resubscription in about a second.

It also tests duplicate and out-of-order webhook delivery.

No Stripe account, API keys in CI, or network access during replay.

It's MIT licensed and currently supports Laravel 11–13.

GitHub: https://github.com/impruthvi/cashier-dunning

I'd especially appreciate feedback from anyone running Stripe/Cashier in production. What billing edge cases would you want something like this to test?

submitted by /u/impruthvi
[link] [comments]

Thoughts about TypePHP

2026-09-08T06:47:55+00:00

submitted by /u/brendt_gd
[link] [comments]

Zero-decimal currencies break the "always store money as cents" rule, and payment libraries mostly do not model it

2026-09-09T05:36:43+00:00

Short version: ISO 4217 assigns an exponent to every currency. Most are 2. XOF, XAF, GNF, JPY, KRW and about twenty others are 0. If your money type assumes minor units are hundredths, every amount in those currencies goes out a hundred times too large.

I hit this integrating West African mobile money and ended up writing a Laravel package around it. The money type holds integer minor units and refuses rather than rounds:

Money::of(1500.50, Currency::XOF); // InvalidMoneyException: XOF is a zero-decimal currency, so 1500.5 cannot be represented

Refusing matters more than it looks. Rounding picks a direction and someone is wrong by a franc on every transaction, forever, and nothing tells you.

The rest of the package is three provider drivers behind one interface, phone parsing that declines to guess an operator when a numbering plan is not documented and stable, idempotent collections, and reconciliation for callbacks that never arrive. 103 tests, zero runtime dependencies beyond Laravel itself.

On verification, because it is the first thing I would ask. Only MTN has met a live sandbox and only partly: MTN has hit Azure's 25,000 subscription cap on its Collections product, so no new developer can subscribe to it and the run had to go through the endpoints their APIs share. Worth doing anyway. It found a double charge bug in my own code, where a replayed reference returns 409 RESOURCE_ALREADY_EXIST and the driver was throwing on it, which would push a caller retrying after a timeout into issuing a fresh reference. Wave and Orange need merchant credentials I do not have, and the README says which paths were exercised and which were not.

Looking for anyone with credentials who wants to prove or break the other two.

https://github.com/catidegla/laravel-mobile-money

submitted by /u/Hour-Swimmer7140
[link] [comments]

I built Phphone: Full PHP 8.4 runtime and CLI for Android and iOS

2026-09-08T13:54:45+00:00

Hi Reddit, I built Phphone, an open-source mobile runtime and anti-framework designed to run full PHP 8.4 directly on mobile devices with zero mandatory cloud dependencies. Instead of writing apps in Dart (Flutter) or relying on heavy JavaScript runtimes (React Native), Phphone embeds the complete Zend Engine into a lightweight native C++ chassis, fully functional across both Android and iOS. Architecture & Low-Level Highlights: Full Native Binaries: Cross-compiled PHP 8.4 (dynamic library on Android, static library on iOS) paired with embedded SQLite3, full libcurl, and OpenSSL. It supports standard PHP libraries, outgoing HTTPS calls, and complex local data pipelines right out of the box. IP Protection (AES-256): To prevent source code extraction from decompilation, all application files in src/ are cryptographically encrypted using AES-256 derived from the project's build keystore. Decryption occurs on-the-fly directly in memory inside the C++ runtime. Hardware-Accelerated UI: The frontend runs inside the platform's native hardware-accelerated WebView over an in-memory micro-server loop (localhost), guaranteeing smooth 60 FPS transitions via standard HTML/CSS/JS. Minimal Footprint: Base Android APK is ~19MB with near-zero idle CPU usage and low RAM consumption. Cross-Platform Ready: Full Android and iOS support is completed. The CLI toolchain automates local scaffolding and builds for both platforms, and our first production app is currently queued for release on both Google Play and the iOS App Store. Live APK Demos Available: To demonstrate that this is a production-ready application engine and not just a theoretical experiment, the website hosts 3 pre-built APKs you can download and test: System & Hardware Demo: A showcase app interacting directly with 14+ native phone APIs and sensors, plus an interactive gradient generator. 2D Gaming Demo: A high-performance 2D game running on PixiJS, powered by local logic. 3D Gaming Demo: A fully interactive 3D scene built with Babylon.js, demonstrating hardware-accelerated WebGL graphics backed by the native PHP engine. Whether for enterprise offline-first software, edge compute nodes, multimedia apps, or 2D/3D games, Phphone proves that modern PHP and standard web technologies can build fast, sovereign mobile apps. Documentation, CLI & APK Downloads: https://phphone.xyz I’d love to hear your thoughts on the low-level C++ embedding, binary optimizations, or the anti-framework approach to mobile architecture.

submitted by /u/Efficient-Zone-7374
[link] [comments]

Aimeos Prisma 0.7 – Access LLMs through a common PHP API

2026-09-08T10:53:38+00:00

Hi r/PHP,

we’ve released Aimeos Prisma 0.7, adding video generation and editing to its text, image, audio, and video APIs.

Prisma is a PHP package for working with AI providers through a consistent interface. It covers text generation and streaming, structured output, embeddings, image editing, speech synthesis, transcription, and video. It works with plain PHP, Symfony, Laravel, or another framework, requires PHP 8.2+, and is MIT licensed.

PHP Prisma

This release lets applications create videos from prompts and reference media, then continue or edit them through the same package. A product-content workflow could generate a product image, use it as the opening frame of a short video, and write the accompanying copy without integrating a separate client for each media type.

What using it looks like

Install it through Composer:

composer require aimeos/prisma

This example generates a video using Google Omni:

use Aimeos\Prisma\Prisma; $video = Prisma::video() ->using('omni', [ 'api_key' => getenv('GEMINI_API_KEY'), ]) ->imagine( 'A ceramic coffee cup on a windowsill, steam rising in the morning light', [], ['duration' => 5, 'aspectRatio' => '16:9'] ); file_put_contents('coffee-cup.mp4', $video->binary());

The current Omni adapter returns completed video data from imagine(), so this example belongs in a background job for a web application. Providers such as Veo and xAI return asynchronous jobs instead: keep their response object in a running worker and call ready() for individual status checks, or access binary() to let Prisma wait and poll until generation finishes. Each status request itself still blocks.

What’s new in 0.7

Video generation now supports Alibaba Wan, Amazon Nova Reel through Bedrock, BytePlus Seedance, Google Omni and Veo, Luma, MiniMax, Runway, xAI, and OpenRouter.

Alongside imagine(), the video API adds:

extend() to continue an existing clip
repaint() to edit a video from a prompt, with reference media on supported providers
uncrop() to expand the video frame
upscale() to increase video resolution

Support varies by provider and model. Applications can check operations with has() or require them with ensure(). Generation uses common media roles such as start, end, and references, with provider-specific options available where needed.

OpenRouter support also expands beyond text: this release adds audio transcription, description, and speech synthesis; image generation, editing, description, OCR, and embeddings; and video generation and description. These operations depend on the capabilities of the selected model.

Also, Ideogram gains V4 generation, remix, and description support, plus text removal, object removal, background removal, and transparent image generation and editing. V4 image generation can run asynchronously, while reference and style options retain V3 routing where supported.

If you like it, give it a star :-)

submitted by /u/aimeos
[link] [comments]

I built an attendance tool in 2023 to escape a paper register. I rewrote it last week, and past me made four real mistakes.

2026-09-07T16:52:23+00:00

In 2022 I started teaching programming to schoolchildren. On the first day I was handed the curriculum for the web track. Nobody could tell me who had written it. After a full year of lessons, the students were supposed to produce an HTML page with a background image and some pictures on it.

I threw it out and wrote a new one.

The other half of the job was the register. Paper, one sheet per child. On every sheet you marked attendance, wrote in the topic of the lesson and the number of hours. That was every group, every week, by hand.

At some point I had enough and built something. It was 2023, I knew PHP, and I wrote it the way you write things at eleven at night: procedural, one file per action. Some colleagues started using it too. Five commits in a single day, two of them named "Add files via upload".

Last week I opened that repository for the first time in three years.

What past me got right

More than I expected. Passwords went through password_hash and password_verify. Eighty-nine prepared statements, and not one place where $_GET was pasted into SQL. For something written to stop filling in paper, that is not bad.

What past me got wrong

htmlspecialchars appears zero times in the whole codebase. Every value from the database goes straight into the page.

The upload handler takes the extension from the filename the browser sent and writes the file into a served directory. You can upload a .php file and then request it. That is remote code execution.

Attendance was stored as (student_id, date, status). No group. A student who came to two different tracks was one row per day, and there was no way to say which of the two they had missed.

A student had a single group_id, so anyone attending two tracks could not be recorded at all.

Teachers and students lived in two tables with two separate login handlers. Anything that concerned both had to be written twice.

The rewrite

Laravel 13 and Postgres. The domain survived and nothing else did.

The interesting part is what the 2023 version never had: tasks that grade themselves.

I do not run student code. It goes to Wandbox, which has been running untrusted code for years and does nothing else. On a project this size, running my own sandbox would mean one person keeping isolation correct in their spare time, and I would rather that person were not me.

I expected to stitch several backends together, the way these things usually go: Wandbox for most languages, the Go playground for Go, the Rust playground for Rust. Then I read the Go playground's compile endpoint. It takes the program body and a version. There is no field for standard input. I posted stdin and input alongside the program anyway, in case the field simply went undocumented, and the program read EOF both times.

Without stdin there is no test case with input data, and without that there is no assessment worth the name. Every task collapses into "print this constant". So I use one backend. Wandbox covers fourteen languages, Rust, Pascal and SQL included.

Grading runs on a queue, because I measured it. One Go build on Wandbox takes about twenty seconds. Five test cases one after another would be a minute and a half. I send them in parallel, four at a time, which got it down to sixty-two seconds. Still far too long to hold an HTTP request open, so submitting queues the work and the page polls for the result.

Some test cases are hidden. For open cases the student sees the input and the expected answer. For hidden ones they see only whether it passed. Show everything and the solution gets fitted to the known answers instead of made to work.

Three findings that cost me an afternoon each

Wandbox's Rust compiler rejects the warning option set, and does not say so. It returns exit status 1 with empty output, which is indistinguishable from a program that printed nothing.

Mono prints non-ASCII as question marks until you set Console.OutputEncoding, and once you do, it prefixes the output with a byte order mark. Comparing that against the expected answer fails on an invisible character. The dotnetcore image on Wandbox does not build at all, so mono is the only option.

Laravel's trans_choice() falls back to the fallback locale in cases where __() returns the key unchanged. My source language is Russian and my fallback was English, so Russian pages rendered English text in exactly the places where a count was involved. No test caught it; I saw it in a screenshot.

What I am not sure about

Leaning on a free public service at the moment a student submits an exam is the obvious weak point, and I do not have a good answer for the day Wandbox is down. My reasoning is that the alternative is worse for a project this size. If you have run the other way and maintained your own isolation, I would like to hear how that went.

MIT, Laravel 13, PHP 8.3+, Postgres, no keys or accounts needed to try it. The seed builds a demo school with four tracks and a month of attendance.

https://github.com/dripips/ItCube

submitted by /u/Successful_Mode8468
[link] [comments]

I wrote a PHP front-end framework — components compiled to JS, SSR + hydration. Here's what running it in production actually pressed on.

2026-09-08T10:58:32+00:00

submitted by /u/IvanVoitovych
[link] [comments]

Symfony Messenger vs Ecotone: The Real Difference

2026-09-08T06:28:52+00:00

submitted by /u/Dariusz_Gafka
[link] [comments]

mousr/templates: Static analysis-friendly native PHP templates

2026-09-07T18:51:12+00:00

Because PHP templates are back! https://github.com/mousr/templates

submitted by /u/TheTreasuryPetra
[link] [comments]

YouMeOS Microverse: Running FrankenPHP + SQLite as an embedded, zero-Docker desktop runtime

2026-09-07T11:13:40+00:00

Hey r/PHP, I wanted to share a practical implementation of FrankenPHP and native SQLite powering a self-hosted personal WebTop: YouMeOS Microverse. A major problem with self-hosted PHP applications is distribution: telling non-technical users to install Docker, Nginx, and MySQL creates massive friction.

How We Utilized FrankenPHP:

Embedded Desktop Engine: In addition to standard Docker Compose, our Electron desktop app bundles a portable FrankenPHP binary with SQLite.
Zero External Dependencies: Users download the .exe, .dmg, or .AppImage, and it runs a local Caddy + PHP 8.3 server process in the background without Docker or local PHP installations.
Resource Footprint: Cold starts take ~1 second, with idle RAM usage significantly lower than traditional Apache/Nginx + PHP-FPM + MySQL stacks.
Caddy Worker Integration: Takes advantage of FrankenPHP's fast application handling directly from local storage.

Livesite: www.youmeos.com but the microverse can be ran locally using our docker container or binaries.

Source code and configs: https://github.com/YouMeOS/youmeos-microverse
Release builds: https://github.com/YouMeOS/youmeos-microverse/releases

Feedback on our FrankenPHP runner and Caddyfile setup is welcome.

submitted by /u/DoItForTheXP
[link] [comments]

HQTUI — Terminal UI for TypeScript, Rust, Go, Python and Zig

2026-09-07T14:38:53+00:00

submitted by /u/Minimum_Hour519
[link] [comments]

No more issues

2026-09-04T06:58:48+00:00

submitted by /u/brendt_gd
[link] [comments]

Give AI Agents Long-Term Memory: LLM Wiki Pattern in Symfony

2026-09-05T09:18:33+00:00

submitted by /u/XenonBG
[link] [comments]

Long-term university system in PHP, microservices or modular monolith, given high staff turnover?

2026-09-03T14:00:33+00:00

Hi everyone,

I work for a Brazilian federal university, and we're starting to plan a new integrated system that will serve the whole university community (from teaching-related services to internal administration). Expected usage is high (many requests across several domains), and the system needs to last many years.

One challenge specific to our context: being public sector, we have high staff turnover on the dev team, so whoever joins later needs to ramp up quickly.

We were initially leaning toward microservices, mostly to keep things scalable and modular over the long run, but after reading some older threads here I'm second-guessing that. Given a small-ish team, high turnover, a long lifespan, and multiple domains, would you recommend starting with a well-structured modular monolith instead of going straight to microservices?

And if microservices do make sense for a project like this, which PHP frameworks/tools would you suggest for building the actual APIs: Laravel, Symfony, Slim, Lumen, something else?

Genuinely trying to learn from people who've been through this. Any experience, even 'don't do it', is welcome!

submitted by /u/phumacinha
[link] [comments]

Is there reputable FOSS library that validates temp email?

2026-09-04T11:43:13+00:00

I know it is a whack-a-mole situtation but I want to know if there is a library that already cover major/famous temporary emails. I plan to restrict registration from temp mail providers to reduce cleanup work from pockers.

Again not a service as I will not send emails to third-party. Also I don't need 100% gate that does not exist. And not asking to help stop them or how to use a library. just a library or code sitting somewhere, since I cannot know all libraries all there

submitted by /u/Dodokii
[link] [comments]

I'm selling my 37+ ElePHPant Collection

2026-09-03T01:16:45+00:00

I'm parting with my ElePHPant collection after 13 years of collecting them. I'm raising money for my startup and also will need open heart surgery in the next 5 years. As the UG leader of PHP Vegas for over 10 years, its been a hell of a run. I still love PHP and my startup is built in it, but I also need funds as I'm quitting my full time to do all this. If we crossed paths before, thank you for all the fish. You can find my collection for sell here: https://www.ebay.com/sch/i.html?_dkr=1&iconV2Request=true&_blrs=recall_filtering&_ssn=pokemastercenter&store_cat=0&_nkw=elephpant&store_name=pokemastercenter&_oac=1

submitted by /u/ogprogrammer
[link] [comments]

Laravel Middleware in Hindi: Create, Alias & Apply to Routes

2026-09-04T09:35:15+00:00

I’ve made a Hindi tutorial on Laravel 12 Middleware covering the complete flow from creating Middleware to applying it on routes.

In this video: • Create custom Middleware • Understand the handle() method • Register Middleware • Create Middleware aliases • Apply aliases to routes • Practical route examples

🎥 Tutorial: https://youtu.be/USOjYgaKUDk

For those learning Laravel 12, hope this helps clear up how Middleware actually works.

submitted by /u/Round-Pie-7125
[link] [comments]

flatbb: a free, open-source PHP forum designed to be extended by AI assistants (no framework, SQLite/MySQL, plugin marketplace)

2026-09-04T09:30:37+00:00

Source: https://github.com/nwnuyhs/flatbb (MIT; added after the comments below asked for it)

I've just released Flatbb 0.1.5, a flat, lightweight forum written in plain PHP 8.1. MIT licensed, free.

No framework, no Composer, no build step. Upload, open the installer, done in 2 minutes. Runs on the cheapest shared hosting or a 1 GB VPS.
SQLite or MySQL 5.7+. Start on SQLite, move to MySQL later with one command.
Built for AI-assisted development. The repo ships CLAUDE.md / AGENTS.md and docs written for AI tools. Open the folder in Claude Code or Cursor, say "add a badge plugin", and it knows the hooks, the rules and how to publish.
Plugin marketplace with one-click install from the admin panel; publish your own plugin with php flatbb plugin:publish.
Discourse-style three-column layout, dark mode, Markdown editor with image upload, full-text search, 7 interface languages.

The interesting part is the developer story: every hook, region and API function is documented in generated Markdown, plugins are plain prefixed functions with a manifest, and the repo includes instruction files for Claude Code / Cursor / Copilot. In practice you describe a plugin in one sentence and the AI writes it, checks it (php flatbb plugin:check) and publishes it to the marketplace.

Source: https://github.com/nwnuyhs/flatbb - Download: https://www.flatbb.com/download - Plugins: https://www.flatbb.com/market

It's early (0.1.x) and I'd love feedback, bug reports and plugin ideas.

submitted by /u/nwnuyhs
[link] [comments]

Digital Sovereignty Is Written in PHP

2026-09-02T14:30:59+00:00

Germany is spending €108 million to move its federal websites onto a TYPO3-based platform. The European Commission runs 770 sites on Drupal. Around 300,000 German federal users work on Nextcloud. All PHP.

Across Europe, when governments say "digital sovereignty," what they're describing is very often a PHP application. In our latest blog post, Sebastian Bergmann looks at where PHP runs in the public sector, why so little of that support reaches the maintainers underneath it, and three practical changes to procurement that could fix it.

submitted by /u/elizabethn
[link] [comments]

GitHub - eznix86/laravel-analytics: Data Build Tool the eloquent way

2026-09-04T03:43:04+00:00

At work, I kept writing the same thing: a few analytics tables, a cron job to rebuild them, and the same SQL copy-pasted into three models. Change one definition, forget to update one copy, and suddenly two dashboards quietly disagree.

There’s `dbt`, which solves this problem for data teams, but it means bringing Python and a second toolchain into a Laravel project. So I tried the same idea in PHP.

An analytics model is an Eloquent model with one query on it:

```php
class Revenue extends Model implements AnalyticsModel
{
use Analytics;

public function computes(): Query
{
return $this->from(Order::class)
->where('status', '<>', 'cancelled')
->per('customer_id')
->measure('total', 'sum(amount)');
}
}
```

Then `php artisan analytics:sync` works out what depends on what and builds everything in the right order.

After that, it’s just Eloquent:

```php
Revenue::query()->where('total', '>', 1000)->get();
```

A few things it does:

* The `GROUP BY` comes from the dimensions you declare, so you never have to write them twice.
* it has Incremental, microbatch, and snapshot buildsthe, same ideas as dbt.
* Runs on PostgreSQL, MySQL, and SQLite with the same commands.

### What it does not do

Every model in a dependency chain has to use the same connection.

That means you can’t, for example, import a SQLite query directly into a PostgreSQL query. This could be solved with an import mechanism, and I am still thinking about a better way to make that work in an Eloquent-like way.

### Why not just use a query class with dependency injection?

A query class, like the action pattern in `App\Queries`, that you inject wherever you need it is perfectly fine.

If the aggregate is fast, you need live numbers, and you only have one or two of them, write the class and skip this package.

The issue is that it computes on every read and you have zero indexes.

Cache the query? Now you’re stuck dealing with stale data.

There’s another problem: each layer (CTEs, subqueries, etc.) gets re-run instead of being reused.

You can use query classes can be composable by calling each other, but a shared subquery is still recomputed inside every caller. This package composes by reference.

For example, you can have a `StgOrder` model representing a transformed version of the `Order` table. It gets built once, and the models that depend on it simply select from the finished table.

This package can append the rows that arrived since the last run, rebuild one day at a time, or keep one row per version with `valid_from` and `valid_to`.

This package will make a built table that can carry the indexes your read patterns need.

A helper like `Revenue::isStale()` can tell you when the data has passed its freshness window.

### Why not just write a job that rebuilds the table?

That’s essentially what the package does.

The difference is that the queries are reusable, and dependencies are propagated through the entire chain of downstream aggregates.

TLDR; You write reusable queries as a data person but in PHP.

Repo: https://github.com/eznix86/laravel-analytics

Read more about DBT: https://en.wikipedia.org/wiki/Data\_build\_tool

the real dbt guys: https://github.com/dbt-labs/dbt-core (for the curious folks)

submitted by /u/Eznix86
[link] [comments]

Laravel 12 + Breeze + Spatie Permissions — Complete Role & Permission Setup

2026-09-04T02:41:52+00:00

If you're working with Laravel 12 and want to implement proper roles and permissions, I put together a complete tutorial using Laravel Breeze + Spatie Laravel Permission.

In the video, I cover:

Laravel 12 + Breeze authentication setup Installing and configuring Spatie Permissions Creating Roles & Permissions Assigning permissions to users Checking roles and permissions Protecting routes with middleware Role-based access control Practical examples with Admin / Manager / Employee roles

🎥 Full tutorial: https://youtu.be/vX46YQprMho Language:Hindi

Hope this helps anyone currently implementing RBAC in Laravel.

submitted by /u/Round-Pie-7125
[link] [comments]