Laravel Junior Code Review: Security and Consistency

Another junior code review, with 10+ tips I can give, emphasizing security issues and consistency.
00:00 Intro: More Reviews and Celebration
01:59 Unused Routes
02:29 Run Artisan without Terminal/SSH
04:02 Blade: Two Ways of Commenting
05:07 Blade: @section or @include?
06:25 Route::get() vs Route::view()
07:16 All-in-one Controller?
08:28 Controller Routes Inconsistent
10:02 Should it be Route::resource()?
10:55 What if you Forget a Middleware?
13:00 Don't Assume You Have the Data
- - - - -
Support the channel by checking out our products:
- Try our Laravel QuickAdminPanel: bit.ly/quickadminpanel
- Enroll in my Laravel courses: laraveldaily.teachable.com
- Purchase my Livewire Kit: livewirekit.com
- Subscribe to my weekly newsletter: bit.ly/laravel-newsletter

[@nmead33]

Congrats on 100k views on the 1st code review video. I enjoy watching and rewatching these vids. Helps with my own refactoring ideas. Would love some future videos on creating tests for the various changes you are making, perhaps creating the tests and running the tests prior to and after refactoring.

[@LaravelDaily]

Yes, it's a great idea. I remember already doing something like this, but can't quickly find that exact video. Which means I need to shoot a new one :)

[@jashanpreet832]

This is great and everyone will learn

[@bktowp0]

Morning starts with code review. Thank you

[@cardboarddignity]

Discovered your channel yesterday. Great content! From my experience, I can say, that as a developer, I used to make same mistakes, when I first learned Laravel. But now it's been like 3 years or so, and while watching these videos, I can say that I'm not junior anymore

[@warpig2786]

This is very valuable, thanks for your time!

[@warrenarnold]

The thumbnail is irreplaceable 🤣🤣🤣🤣🤣 I love your channel Nice explanation behind the reason why. Your channel is underated🙌

[@Claudio_Pereira]

Povilas, again, thank you very much. The knowledge I acquire in your videos is often superior to what I could learn in a formal course or even in college. Congratulations.

[@Rocknrolla112]

awesome idea to make playlist, and hope there will be more reviews :)

[@yahikkonr6350]

Good, explanation of best practices about laravel code patterns, ex: repository, service, api, controller ...

[@whtht]

Haha its so fun to review juniors code :D

[@alfiantorobudiputranto8569]

I think this is a great video, make everyone will learn the best practice for writing a code..

[@tlita93]

100k hah? Amazing sir. Immediately after you made that first video I thought it would be extremely popular. As I already commented on one of your videos, everything I wanted to see, as I was learning PHP and then Laravel, is the real world example, a real project, code/repo that has couple of hundred or thousands of commits and it's constantly updated to live server - SSH or whatever. To see why and how I am gonna use my knowledge in a real world scenario. You always learn about some, I dare say "silly", examples that kinda don't make sense in the big(ger) picture. Thank you for everything and don't work too hard sir. :) Cheers

[@devKazuto]

For code cleanup/consistency I'm using php-cs-fix. Before committing I'm running composer fix and all code will be checked and uniformly (single quotes, indentation) formatted and deletes unused 'use' and can order 'use' by different criteria.

[@imedtech1256]

very interesting method to learn keep going like this videos thank you

[@LaravelLover]

Such a great video, you are real hero man

[@matejcerny4459]

Maybe I have advice for you. If you have a condition like : $contact = Contact:where(....); if ($contact) { ..... } You can place $contact = Contact:where(...); inside "if" So it will look like if ($contact = Contact:where(....)) {} And then you can call the variable in that return; In my opinion, it looks cleaner. You can also use Contact::whereFirst instead of where(...)->first() Anyway, thanks for your work. Best youtube channel in my opinion.

[@rishharris8808]

thank you so mush for you wonderful content

[@esilvajr]

Good review but its important explain the use of try/catch when using firstOrFail eloquent's method. I see a lot of people using firstOrFail and they not catch the ModelNotFoundException and just let de "Exception/Handler" handle it. Nice video content, congratulations.

[@baadrqaaba9529]

This is a good content to see on KZbin, not as tiktoker's stupid dance. I have learned a lot thank you .

[@nikitajolobov4375]

thank you a lot, you are great!!!

[@yahyazakaria6584]

Thank you so much :)

[@taslimsuman]

Always great

[@mspiderv]

15:57 The $address->field = $request->field part. I use to write this thing as follows: $address->forceFill($request->only['field1', 'field2', 'field3' ...]) I think it's better because you need to name your fields only once (not twice). And of course you can use "fill" instead of "forceFill" if you configured your $fillable property in Address model.

[@sodomousprime]

Yes these code reviews are great, please keep them up. Also what I think is a good topic that no one has really covered as of yet, is what components in jetstream are reusable for guest side of client browsing, like adding guest() and auth() to jetstream components.

[@LaravelDaily]

Currently I'm not planning more videos about Jetstream, I've published a few of them but they weren't popular enough, so not too many people actually use or want more tips on Jetstream, as numbers show.

[@sodomousprime]

@@LaravelDaily Thank you for your response. Personally I think its a bit too complex still as there is not many tutorials on the subject other than installing and configuring the auth side. Until this changes it will stay a niche topic unfortunately.

[@miro-hristov]

Just wanted to let you know this website is live and googleable and the /clear /migrate routes are still accessible publicly. Might want to let them know. I hope I didn't break anything. Thanks for the great content!

[@LoganathanNatarajanlogudotcom]

Thanks

[@bestsolution794]

Awesome ❤️

[@ridwanbakare8972]

This is nice.

[@ridwanbakare8972]

Its constructive criticism, I hope when I get to build my first project, I'll send mine too and it get reviewed

[@GergelyCsermely]

Thanks.

[@RajibDas-hb6qt]

Great Sir...Kindly do some professional project for us...

[@atatopatato]

Model::where('id', 1) can be changed to Model::find(1)

[@alila3883]

Nice 👍👍

[@adebajooluwaseyi2124]

amazing

[@skills_set]

great, about returning views, if i want to return to a view with some data, which is advisible to use, direct from view or from controller

[@pasizdobrekuce]

Amazing! That said, that "text ticker" in the header is very annoying. Otherwise, excellent!

[@debjit21]

Yes! leared a lot. I use migrate inside admin so only admin can migrate and clear the cache. And when migrating use "--force" because the app is in production mode.

[@bumblebity2902]

As Povilas said, try to persuade client to store laravel project in dedicated hosting. If client is stingy and use shared hosting, artisan commands should be protected by admin/superAdmin middleware.

[@Stoney_Eagle]

Having these artisan commands available from the web is not a bad idea, but i would hide them in an ajax api route with if user is admin. If you have a huge amount of routes you should separate them in different files. I created an admin and user route file and attach the main Middlewares inside the route service provider so the code is more readable. Only my public routes are in web 😉 Remember the days where coding was more pain than joy? Laravel has removed all that pain, doesn't realy matter how bad you do things anymore... It just works or it tells you exactly what you did wrong.

[@Jurigag]

16:23 here it depends, personally for writing i prefer having small tables, user most of the time don't want to edit everything and then have projection(read model) which would consist of all this data in one table which would be populated by events. Especially if i need to access it often. This is especially important if you have like a lot of joins, sometimes it's better to denomralize model for reading and keep it normalized only for writing.

[@josephbassey1249]

I understand but having your whole configuration in a single table is a good practice 🖐️

[@shocchosolutions6275]

sir you are the best sir how we integrate voice call or video call functionality in our website

[@KatieGeorgieva]

When a controller does one thing why not use an invokable controller?

[@LaravelDaily]

Good tip. I should probably shoot a separate short video about invokable controllers, I don't see them used often enough.

[@supercal2010]

@@LaravelDaily Yes please do!

[@lucagrandicelli]

I prefer not to use invokables too much because you'll never know if it comes to add a new method in it. Also, a method name helps you to better understand the underlying logic. But it's up to you.

[@7105597]

Once again, excellent video! - I find helpful you repeating suggestions like "use groups" (and so on). You could use less time handling them, as you did, but it's good to remember, and for new persons watching your videos. In other hand, I'm working in an API. How normal is use routes (from apiResources) for handle multiple entries. For example: store method receives an array of new Products. What's the convention here, store MUST create just ONE Product? or can I use it to create multiple Products? Since I'm trying to create multiple products, I would like to see a video from you talking more about the last topic (you talked about in this video), handling errors with data. Must I use for loops asking if one ID exist? (using firstOrFail), must I use "try - catch" and custom exceptions? - Also, I could check for unique using $request->validate, but what about unique between the new incoming products ! - I have been researching about these error handling systems, but... Im not satisfied with my current state. Thanks for the tip about the IDE, it's awesome! (this comment is not sponsored!)

[@LaravelDaily]

Hi Cristhian, thanks for a long comment. It's hard to have one answer for all your question, it's very individual. Those Route::resource or Route::apiResource follow the standard that store() is for one record, so what you're doing is probably a CUSTOM method/URL like import(Request $request) where you would loop through the records, and then it's up to you to decide how to handle validation - stop on the first error, loop through the list of errors, insert into DB all successful records, etc.

[@7105597]

Thanks to you for the reply. These style of videos are one of the best methods for me to learn/improve a new language/framework, and not all people do. Thanks for your time and effort to answer most of the comments. Your answer was helpful, and gave me some peace, so, once again, thanks! Keep being strict, and show us how to improve in Laravel! (and maybe, some other related technologies! - e. g. CD/CI; kubernetes; NoSQL (which Im working with (MongoDB))

[@piyushkumardongre5873]

Hi, How to generate Laravel models from an existing database design?. Also, can I set somewhere which one of them are of Resource type.

[@borissman]

7:00 - no, you are not repeating yourself. Please consider continuing in the same way!

[@LaravelDaily]

Well, for me it seems that I'm talking about the same things in like 3rd or 5th junior review, but maybe it's because I've watched them all myself :) Maybe other visitors of my channel are not so active.

[@borissman]

​@@LaravelDaily Yea, i completely understand your point of view xD

[@EDDIEcodename47]

Didn't know you can use console commands in "code".. Live and learn.

[@alexevlad]

I really enjoy this types of videos, because is helping me/us better to write code. What I found very hard these days to understand was JWT & Repository Pattern, what I had seen on some projects what are using it. I'm trying to build a dashboard application with Laravel & React, and I fail at that point of JWT login/register. I had seen library's alternative like Sanctum, would you recommend me to use it? Thanks for reading the comment 🌟

[@LaravelDaily]

Of course I recommend Sanctum, as it's official Laravel library. But I work with Vue and not React, so not sure if it has any other nuances.

[@warrenarnold]

@@LaravelDaily i found a good tut at pusher on working with react and laravel however for auth i use fortify as instructed by laravel daily. Then copied the react auth parts from the previous project. customizing several custom redirect depending on login type of user was nt hard. However what i found impossible is customizing the redirect on failed login, or redirecting to correct login form when trying to access protected routes. Please can u touch on that , where is the fortify auth middleware and hw to customize it......and try out the react with laravel thing its cool.

[@AnonymOus-dp3jj]

Why I add them into an admin setting page, to clear cache , routes, etc

[@johnyonardpauly5601]

I was shocked on the video thumbnail.

[@codewithtee]

Good morning, what could make a route return 404 after you run the Artisan command. I am not sure of which I command I ran, I just noticed that particular route I just added was returning 404

[@LaravelDaily]

Sorry we can't debug it for you and blindly guess what you did wrong.

[@ifeanyinnaemego]

Is there a project on video upload with progress bar

[@khafi22]

Should we expect a livewire version of quickadmin panel? If yes when?

[@LaravelDaily]

Yes, end of Spring

[@sidneyonahon602]

Hi sir can I join your training bootcamp? I am a developer but eager to learn backend so that I can be fullstack

[@LaravelDaily]

Currently not planning bootcamp in near future, but watch the channel for any news.

[@sidneyonahon602]

@@LaravelDaily ok sir thanks

[@warrenarnold]

@Laravel Daily i found a good tut at pusher on working with react and laravel however for auth i use fortify as instructed by laravel daily. Then copied the react auth parts from the previous project. customizing several custom redirect depending on login type of user was nt hard. However what i found impossible is customizing the redirect on failed login, or redirecting to correct login form when trying to access protected routes. Please can u touch on that , where is the fortify auth middleware and hw to customize it......and try out the react with laravel thing its cool.

[@hemantbhardwaj17]

16:52 why he even need where instead of find() he is targeting the ID

[@louisevirtudazo2822]

"Junior" developer not knowing all the function. Its fine, beginner's mistake

[@resin01]

They do not. Both will run the exact same query, so it's a matter of preference. I would prefer ->find() as well (or probably dependency injection with route model binding)

[@ltroya]

Sometimes when you buy a shared hosting you dont have access to the console

[@zoroXgamings]

Can you do my laravel project code review ?

[@LaravelDaily]

Currently, I have a big queue of reviews already. Unless you have a specific problem(s) or question(s) that I can review which will lead into some topic-based video.

[@m.Baobaid]

Is it possible for us to send you our project to review it?

[@LaravelDaily]

Currently, I have a big queue of reviews already. Unless you have a specific problem(s) or question(s) that I can review which will lead into some topic-based video.

[@kieran1990able]

Man, how come these junior dev make slick design and when I make, it looks always shit. I really don't have good eye for design. Any tips for that?

[@LaravelDaily]

Tailwind UI is a good example of design. Not necessarily for purchase but to get ideas.

[@kieran1990able]

@@LaravelDaily Thanks :)

[@rsgjunior99]

Most of those are free templates. The template used for the admin area on this video is AdminLTE.

[@kieran1990able]

@@rsgjunior99 cool, can you recommend some websites with best design templates?

[@user-lj2ou4db3c]

Is there a way to send you my project for code review, I'm also junior ?

[@LaravelDaily]

For now, I think I'm done with junior reviews because they start to be very similar, repeating each other. But you can send and I will take a look if there's something individual worth shooting a video. Email me [e-mail] with more details and invite me to repository, GitHub username povilaskorop

[@alicenNorwood]

When you are even doing a refactor of own video titles

[@webhimel]

very helpful for junior developer, Do you want to review my code?

[@LaravelDaily]

Sorry I don't have free time anymore for perosnal reviews.

[@rajabhishek2936]

Awosem

[@husniddintogizov7324]

He needs one extra route /db/drop

3:16 he/she would know 😉

[@tomaszdrabik79]

to be honest, that will always happen, when guys watching "tutorials" on KZbin from developers of "copy - paste" :)

[@muhammadfarhanahmed9280]

This is great and everyone will learn