Building CRUD Applications in Laravel

# CHAPTER 10

Building CRUD Applications in Laravel #

1. Introduction #

2. Learning Objectives #

• Use Artisan to generate a Model, Migration, and Resource Controller simultaneously.

• Wire a Resource Controller to a resourceful Route.

• Build the Views required for listing, creating, and editing records.

• Implement the complete CRUD data flow.

3. Beginner-Friendly Explanation #

4. Step 1: The Magic Generation Command #

Open the terminal:

php artisan make:model Post -mc

*(The -mc flag tells Artisan: "Make a Model, and also make a Migration and a Controller!)*

5. Step 2: The Migration and Model #

public function up() {
    Schema::create('posts', function (Blueprint $table) {
        $table->id();
        $table->string('title');
        $table->text('content');
        $table->timestamps();
    });
}

Run php artisan migrate.

Model (app/Models/Post.php):

class Post extends Model {
    protected $fillable = ['title', 'content']; // Allow Mass Assignment
}

6. Step 3: The Resource Route #

routes/web.php:

use App\Http\Controllers\PostController;

// This single line generates all 7 CRUD routes automatically!
Route::resource('posts', PostController::class);

7. Step 4: Building the Controller (The Logic) #

<?php
namespace App\Http\Controllers;
use App\Models\Post;
use Illuminate\Http\Request;

class PostController extends Controller
{
    // READ: Show all posts
    public function index() {
        $posts = Post::all();
        return view(&#039;posts.index', compact('posts'));
    }

    // CREATE (Show Form)
    public function create() {
        return view(&#039;posts.create');
    }

    // CREATE (Save Data)
    public function store(Request $request) {
        Post::create($request->all());
        return redirect()->route(&#039;posts.index')->with('success', 'Post created!');
    }

    // DELETE (Destroy Data)
    public function destroy($id) {
        $post = Post::findOrFail($id);
        $post->delete();
        return redirect()->route(&#039;posts.index')->with('success', 'Post deleted!');
    }
}

8. Step 5: Building the Blade Views (The UI) #

index.blade.php (The Dashboard):

<h1>All Posts</h1>
<a href="{{ route(&#039;posts.create') }}">Create New Post</a>

<ul>
    @foreach ($posts as $post)
        <li>
            {{ $post->title }} 
            
            <!-- DELETE BUTTON (HTML forms only support GET/POST, so we use a Laravel method spoof) -->
            <form action="{{ route(&#039;posts.destroy', $post->id) }}" method="POST" style="display:inline;">
                @csrf
                @method(&#039;DELETE')
                <button type="submit">Delete</button>
            </form>
        </li>
    @endforeach
</ul>

create.blade.php (The Form):

<h1>Create Post</h1>
<form action="{{ route(&#039;posts.store') }}" method="POST">
    @csrf
    <input type="text" name="title" placeholder="Title"><br>
    <textarea name="content" placeholder="Content"></textarea><br>
    <button type="submit">Save Post</button>
</form>

9. The Method Spoofing Trick (@method('DELETE')) #

10. Common Mistakes #

• Putting Delete Actions on <a> Tags: Beginners often write <a href="/posts/delete/5">Delete</a>. This is a massive security flaw. Search engine web-crawlers click every <a> link they find. If Google crawls your dashboard, it will click all your delete links and erase your database! Delete actions MUST always be submitted via a POST/DELETE <form>.

11. Exercises #

1. 1. Trace the execution path: A user fills out the create.blade.php form and clicks Submit. Which route catches it? Which controller method handles it? Where does the data go?

12. Coding Challenges #

• Challenge: The Controller code above omits the Update logic. In PostController, write the edit($id) method to fetch a post and return an edit.blade.php view, and write the update(Request $request, $id) method to save the changes.

13. MCQs with Answers #

14. Interview Questions #

• Q: Explain how Route::resource('photos', PhotoController::class) simplifies application routing compared to defining individual routes.

• Q: Why is it a severe security anti-pattern to trigger a database DELETE operation via a standard HTTP GET request (an <a> tag)?

15. FAQs #

16. Summary #

17. Next Chapter Recommendation #