laravel

Laravel Best Practices (2025)

This guide outlines the definitive best practices for developing robust, scalable, and maintainable Laravel applications. Adhere to these principles to ensure your codebase is clean, performant, and secure, aligning with PSR-12, PHP The Right Way, and Laravel's conventions.

1. Code Organization & Structure

1.1 Thin Controllers, Fat Models/Services

Controllers orchestrate requests; they do not contain business logic. Delegate complex operations to dedicated Service classes or Model methods.

❌ BAD: Business logic in Controller

// app/Http/Controllers/OrderController.php
class OrderController extends Controller
{
    public function store(Request $request)
    {
        $order = new Order();
        $order->user_id = Auth::id();
        $order->total = $request->input('price') * 1.20; // Calculate total with tax
        $order->status = 'pending';
        $order->save();

        // ... more logic
    }
}

✅ GOOD: Delegate to a Service

// app/Services/OrderService.php
class OrderService
{
    public function createOrder(array $data): Order
    {
        $order = new Order();
        $order->user_id = $data['user_id'];
        $order->total = $data['price'] * 1.20; // Business logic encapsulated
        $order->status = 'pending';
        $order->save();

        return $order;
    }
}

// app/Http/Controllers/OrderController.php
use App\Services\OrderService;

class OrderController extends Controller
{
    public function __construct(private OrderService $orderService) {}

    public function store(Request $request)
    {
        $order = $this->orderService->createOrder([
            'user_id' => Auth::id(),
            'price' => $request->input('price'),
        ]);

        return response()->json($order, 201);
    }
}

1.2 Centralized Validation with Form Requests

Always use Form Request classes for validation. This keeps controllers clean and validation logic reusable.

❌ BAD: Validation in Controller

// app/Http/Controllers/PostController.php
class PostController extends Controller
{
    public function store(Request $request)
    {
        $request->validate([
            'title' => ['required', 'string', 'max:255'],
            'body' => ['required', 'string'],
        ]);
        // ...
    }
}