PHP Best Practices and Project Structure

# Chapter 29: PHP Best Practices and Project Structure

1. Introduction #

2. Learning Objectives #

• Understand the DRY (Don't Repeat Yourself) principle.

• Structure a PHP project directory professionally.

• Write readable, self-documenting code.

• Understand the importance of the .env file for configurations.

• Familiarize yourself with PHP-FIG and PSR standards.

3. The DRY Principle #

4. Professional Folder Structure #

Example Structure:

/my_project
├── /public            <-- The ONLY folder accessible by the browser
│   ├── index.php      <-- Central router
│   ├── /css
│   ├── /js
│   └── /images
├── /src               <-- Your backend code (Hidden from public)
│   ├── /Controllers
│   ├── /Models
│   └── /Views
├── /config            <-- Database connections
├── /vendor            <-- Third-party libraries (Composer)
└── .env               <-- Secret environment variables

5. The .env File (Environment Variables) #

.env

DB_HOST=localhost
DB_USER=root
DB_PASS=mySecretPassword

Using libraries like vlucas/phpdotenv, PHP reads this file securely, allowing your code to look like this:

$pdo = new PDO("mysql:host=" . $_ENV['DB_HOST'], $_ENV['DB_USER'], $_ENV['DB_PASS']);

6. Self-Documenting Code #

Bad (Unclear):

$d = 5;
if ($d > 3) { doA(); }

Good (Self-Documenting):

$user_failed_login_attempts = 5;
$max_allowed_attempts = 3;

if ($user_failed_login_attempts > $max_allowed_attempts) {
    lockUserAccount();
}

*Notice how the "Good" code barely needs comments. The variable and function names explain exactly what is happening.*

7. PSR Standards #

• PSR-1 & PSR-12 (Coding Style): Rules like using <?php (no short tags), using CamelCase for methods, PascalCase for Classes, and indenting with 4 spaces.

• PSR-4 (Autoloading): A standard that allows PHP to automatically find and require your Classes based on your folder structure, so you never have to write require 'Model.php'; manually again.

8. Real-World Examples #

9. Output Explanations #

10. Common Mistakes #

• Magic Numbers: Using if ($status == 4) in your code. What does 4 mean? Use constants or clear variables: if ($status == STATUSBANNED).

• Leaving test code: Leaving vardump($_POST); die(); in your live code.

• Not using Source Control: Building a massive project without using Git and GitHub. If you delete a file by accident without Git, it is gone forever.

11. Best Practices #

• KISS (Keep It Simple, Stupid): Don't write a highly complex, confusing one-line block of code just to show off. Simple, readable code is always better.

• Validate incoming data immediately. Escape outgoing data at the very last possible second before it hits the HTML.

12. Exercises #

1. 1. Look at the code you wrote for Chapter 22 (CRUD). Are your variable names descriptive? Are your database credentials hardcoded?

1. 2. Refactor a script by moving the database connection logic into a separate config.php file and including it.

13. Mini Project: Refactoring Legacy Code #

Legacy Spaghetti:

<?php
$e = $_POST[&#039;e'];
$p = $_POST[&#039;p'];
if($e != "" && $p != ""){
$db = new PDO("mysql:host=localhost;dbname=test", "root", "");
$s = $db->prepare("SELECT * FROM users WHERE email=:e");
$s->execute([&#039;:e'=>$e]);
$u = $s->fetch();
if($u && password_verify($p, $u[&#039;pass'])){
$_SESSION[&#039;user'] = $u['id']; echo "yes"; } else { echo "no"; } }
?>

Refactored Clean Code:

<?php
session_start();
require_once &#039;config/database.php'; // DB connection hidden away

// 1. Clear variable names and early return
$email = trim($_POST[&#039;email'] ?? '');
$password = $_POST[&#039;password'] ?? '';

if (empty($email) || empty($password)) {
    die("Email and password are required.");
}

// 2. Clear query logic
$stmt = $pdo->prepare("SELECT id, password_hash FROM users WHERE email = :email");
$stmt->execute([&#039;:email' => $email]);
$user = $stmt->fetch();

// 3. Clear Authentication logic
if ($user && password_verify($password, $user[&#039;password_hash'])) {
    $_SESSION[&#039;user_id'] = $user['id'];
    echo "Login successful.";
} else {
    echo "Invalid credentials.";
}
?>

14. Coding Challenges #

15. MCQs with Answers #

2. Why should database credentials be placed in a .env file instead of directly in the PHP script? A) Because .env files execute faster. B) To keep secrets out of version control (like GitHub) and separate configurations from application logic. C) Because PHP requires it. D) To make the database run faster. *Answer: B*

3. What is Composer used for in PHP? A) Writing CSS. B) Managing dependencies and third-party libraries. C) Designing databases. D) Hosting websites. *Answer: B*

16. Interview Questions #

Q: What are PSR standards? *A:* PHP Standard Recommendations (PSR) are a set of guidelines published by the PHP-FIG. They standardize coding styles (PSR-12) and autoloading (PSR-4), ensuring that code written by different developers or frameworks remains consistent, interoperable, and highly readable across the global PHP ecosystem.

17. FAQs #

18. Summary #

19. Next Chapter Recommendation #