Türker Yıldırım

php

  • Restructuring an application for Laravel 5

    Deep dive10 min read

    4.2 to 5.0 is not an upgrade, it is a relocation. Moving an application through it in an order that keeps it booting at every step.

  • microtime benchmarking measures your loop as well

    Note1 min read

    Wrapping a call in two microtime(true) readings looks like a measurement and is mostly noise: one iteration, no warm-up, and the timing includes whatever the loop and the…

  • PHP-FPM pm=dynamic numbers come from RAM, not from taste

    Note1 min read

    The default pool ships with pm.max_children = 50, which on a small server is not a limit so much as an invitation to swap. The number should come…

  • preg_quote takes a delimiter argument

    Note1 min read

    Interpolating user input into a pattern is how a search box becomes a regular expression injection. preg_quote() escapes the metacharacters, but its default output is still not safe…

  • dump-autoload -o is not optional in production

    Note1 min read

    PSR-4 resolves a class by converting the namespace to a path and checking the filesystem. That is one or more stat calls per class, on every request, for…

  • Generators keep a million-row export inside memory

    Note2 min read

    A method that builds an array and returns it holds every row in memory at once. For an export of a few hundred rows that is invisible; for…

  • pre_get_posts is the hook query_posts pretends to be

    Note2 min read

    query_posts() replaces the main query after WordPress has already run it, which throws away the first result set, breaks pagination and leaves conditional tags lying about what page…

  • use function and use const, not just use for classes

    Note1 min read

    Namespaced code can import classes with use, but until 5.6 functions and constants had no equivalent. Calling a namespaced function meant either fully qualifying it every time or…

  • Write an array to CSV in PHP

    Snippet1 min read

  • Nonces are not permissions — check both

    Note1 min read

    A nonce proves the request came from a form your site rendered, recently. It says nothing about whether the person submitting it is allowed to perform the action…