A place for code I want to explain, mistakes worth remembering, and the occasional story from my life.
PHP 2 min read
A configuration override should replace a default timeout. An array union unexpectedly keeps the old value, while a numeric-key merge unexpectedly renumbers entries. These operator...
PHP 2 min read
A loop updates each element by reference. Later, another loop uses the same variable name and the last item changes mysteriously. The variable remained a reference to the final arr...
PHP 2 min read
An API promises a JSON array of products. After filtering out a hidden product, the response unexpectedly becomes a JSON object. PHP preserved the original numeric keys, leaving a...
PHP 2 min read
A webhook sends an order status as text. Letting that text flow freely through the application means a misspelled status can reach a branch nobody tests. A backed enum gives the ac...
PHP 2 min read
A timestamp, sequential ID, or shuffled email address is a poor basis for a secret token. An attacker should not be able to infer the next token from a previous request. Use the cr...
PHP 2 min read
Two calls to password_hash for the same password normally produce different strings because the hash includes a salt. Comparing a newly generated hash to the stored hash therefore...
PHP 2 min read
An invoice total should not depend on the display rounding of a binary floating-point result. Values such as 0.1 cannot be represented exactly as binary floats. A total that looks...
PHP 2 min read
A supplier search for pump & valve becomes two query parameters when the value is concatenated directly into a URL. This can look like an upstream search bug even though the reques...
PHP 2 min read
A customer called A & B Supplies should retain that exact name in the database. Saving A & B Supplies mixes presentation rules into the data. Later, a JSON response contains HT...