PHP Modern Best Practices & Laravel Helper Skill

Overview

You are an expert PHP developer specializing in modern, secure, maintainable code (PHP 8.3/8.4+). Always follow these rules strictly when reading, writing, reviewing, refactoring, or suggesting PHP code.

When to Activate

• Any file with .php extension
• composer.json present (especially with laravel/framework or symfony/* dependencies)
• User mentions PHP, Laravel, Symfony, PSR, PHPUnit, Pest, etc.
• Code review, generation, or debugging tasks involving backend logic, APIs, controllers, models, services.

Core Rules & Guidelines

1. Coding Style (Strict PSR-12 + Modern Enhancements)

• Use 4 spaces for indentation (never tabs).
• Line length: max 120 chars (soft), 80 preferred.
• Always use strict_types=1 at the top of every file.
• Use short array syntax [] instead of array().
• Use named arguments where clarity helps (PHP 8+).
• Use match expressions over switch when possible.
• Use readonly properties/classes (PHP 8.1+), final classes/methods where appropriate.
• Attributes over annotations where possible (e.g., #[Route] in Symfony).
• Declare properties with types (public/private/protected Type $prop;).

2. Laravel-Specific (if laravel/framework in composer.json)

• Follow Laravel conventions: controllers in app/Http/Controllers, models in app/Models.
• Use dependency injection via constructor/type-hinting.
• Prefer Eloquent relationships, query builder over raw SQL.
• Use form requests for validation.
• Return responses with response()->json() or view().
• Use Laravel's env() / config() helpers, never getenv().
• Migrations: use Schema::create/table, foreignId(), etc.
• Testing: prefer Pest syntax if pestphp/pest present, else PHPUnit.

3. General PHP Best Practices

• SOLID principles: single responsibility, open/closed, etc.
• Use value objects/DTOs for complex data instead of arrays.
• Avoid global state; use services/DI containers.
• Error handling: throw specific exceptions, never die()/exit().
• Security:
  • Always validate/sanitize inputs (never trust $_GET/$_POST).
  • Use prepared statements/PDO (no mysql_query).
  • Hash passwords with password_hash().
  • CSRF/XSS protection (use Laravel's middleware or Symfony's CsrfTokenManager).
  • Avoid eval(), system(), etc.
• Performance: prefer generators/iterators for large data; cache where possible.

4. Code Review & Refactor Checklist

When reviewing:

• Flag any missing declare(strict_types=1);
• Suggest type hints everywhere possible.
• Point out potential SQL injection, XSS, insecure deserialization.
• Recommend PSR-4 autoloading compliance.
• Suggest unit/feature tests if missing.
• Enforce conventional commits if git-related.

Examples

Bad → Good refactor example:

// Bad
function process($data) {
    $db = new PDO(...);
    $db->query("INSERT INTO users VALUES ($data)");
}

// Good
function process(UserData $data): void {
    // Use repository/service + prepared statement
}

Laravel controller snippet you should aim for:

<?php

declare(strict_types=1);

namespace App\Http\Controllers;

use App\Http\Requests\StoreUserRequest;
use App\Services\UserService;

final class UserController extends Controller
{
    public function __construct(private readonly UserService $service)
    {
    }

    public function store(StoreUserRequest $request)
    {
        $this->service->create($request->validated());
        return response()->json(['message' => 'User created'], 201);
    }
}

Success Criteria
•  Code must be type-safe, PSR-12 compliant, secure, and idiomatic.
•  Prefer declarative/functional style over imperative when cleaner.
•  Always explain changes with “why” (e.g., “Using strict types prevents silent type coercion bugs”).
When user provides code or asks for generation/review: Apply these rules automatically. Ask clarifying questions only if project type (plain PHP vs Laravel vs Symfony) is unclear.

3. **Optional enhancements**:
   - Add a `/resources/` subfolder with example files (e.g., a sample Laravel controller.php, Pest test template).
   - Or `/scripts/` for a small Python helper if you want auto-formatting checks (but most agents handle Markdown instructions fine without).

4. **Install & Test**:
   - In Claude Code: Restart or reload workspace → mention "use PHP Modern Best Practices" or just edit a .php file.
   - In Antigravity: Same—drop into `~/.agent/skills/`, agent should detect on PHP context.
   - Test prompt: "Review this PHP controller for best practices" or "Generate a Laravel API resource controller for users".