laravel-best-practices

Laravel Best Practices

Best practices for Laravel, prioritized by impact. Each rule teaches what to do and why. For exact API syntax, verify with search-docs.

Consistency First

Before applying any rule, check what the application already does. Laravel offers multiple valid approaches — the best choice is the one the codebase already uses, even if another pattern would be theoretically better. Inconsistency is worse than a suboptimal pattern.

Check sibling files, related controllers, models, or tests for established patterns. If one exists, follow it — don't introduce a second way. These rules are defaults for when no pattern exists yet, not overrides.

Quick Reference

1. Database Performance → rules/db-performance.md

• Eager load with with() to prevent N+1 queries
• Enable Model::preventLazyLoading() in development
• Select only needed columns, avoid SELECT *
• chunk() / chunkById() for large datasets
• Index columns used in WHERE, ORDER BY, JOIN
• withCount() instead of loading relations to count
• cursor() for memory-efficient read-only iteration
• Never query in Blade templates

2. Advanced Query Patterns → rules/advanced-queries.md

• addSelect() subqueries over eager-loading entire has-many for a single value
• Dynamic relationships via subquery FK + belongsTo
• Conditional aggregates (CASE WHEN in selectRaw) over multiple count queries
• setRelation() to prevent circular N+1 queries
• whereIn + pluck() over whereHas for better index usage
• Two simple queries can beat one complex query
• Compound indexes matching orderBy column order
• Correlated subqueries in orderBy for has-many sorting (avoid joins)

3. Security → rules/security.md

• Define $fillable or $guarded on every model, authorize every action via policies or gates
• No raw SQL with user input — use Eloquent or query builder
• {{ }} for output escaping, @csrf on all POST/PUT/DELETE forms, throttle on auth and API routes
• Validate MIME type, extension, and size for file uploads
• Never commit .env, use config() for secrets, encrypted cast for sensitive DB fields