From the blog

Notes on PHP, Drupal, Laravel, React, and Next.js development.

Jun 2026

PHP Security Best Practices: Preventing SQL Injection, XSS, and CSRF

The PHP security fundamentals that actually stop real-world attacks: prepared statements for SQL injection, output-context escaping for XSS, CSRF tokens, proper password hashing, safe file upload handling, and keeping dependencies patched.

Jul 2026

Laravel Nova Composer auth.json: Local Development Without Committing Credentials

How Laravel Nova's private Composer authentication works, why auth.json shouldn't be committed to Git, and the legitimate ways around it — COMPOSER_AUTH, a global per-machine auth.json, and CI/Docker secrets.

Jun 2026

Drupal Views Module: A Beginner's Guide

Drupal Views from the ground up: displays, fields, filters, sorts, contextual filters, relationships for pulling in referenced entity data, exposed filters, Views' own query caching, and exporting views as version-controlled configuration.

Jun 2026

React Server Components Explained for Beginners

React Server Components explained from the actual problem they solve (shipping less JS, not just server-rendering): the Server vs Client Component distinction, why server-only resources are safe in RSC, when 'use client' is genuinely needed, and how to compose the two together correctly.

Jun 2026

Next.js Server Actions: Complete Guide with Examples

Next.js Server Actions in depth: defining them with 'use server', using them directly as a form's action (works without client JS), revalidating the cache after a mutation, pending/error state with useFormStatus and useActionState, calling actions outside forms, and why they need their own server-side authorization checks.

Jun 2026

Composer Autoloading Explained: PSR-4 vs Classmap

PSR-4 vs classmap vs 'files' autoloading in Composer, dev-only autoload mappings, production autoloader optimization flags (-o, --classmap-authoritative), and why 'class not found' resurfaces after adding new classes.

Previous 1 2 3 4 5 6 7 Next