Laravel Fundamentals
Laravel is a PHP framework for building server-side web applications and APIs. It bundles routing, an object-relational mapper called Eloquent, the Blade template engine, validation, authentication, queues, and a command-line tool called Artisan into one coherent system, so a team follows shared conventions instead of assembling a separate library for every common task.
itWeb development | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Don't Panic
Don't Panic: Laravel Fundamentals
Laravel is a PHP framework for web applications and APIs where the server owns the data and the business rules. It exists because building routing, database access, templating, validation, login, permissions, and background jobs from separate parts leaves every project with its own set of seams to trip over. Laravel picks one set of conventions so a team, and the next person who reads the code, only has to learn them once. Before it, the PHP world mostly did assemble those parts by hand, or used CodeIgniter, which Laravel was written to improve on.
The first thing worth holding onto is a single request. Every web request enters at one file, public/index.php, which builds the application. That application is also the service container, the object that constructs your classes and hands each one the things its constructor asks for. The request then passes through middleware, which can inspect or reject it, reaches a route that points at a controller, and the controller does the work and returns HTML, JSON, or a redirect. Trace that trip once and a lot of Laravel stops looking like sleight of hand.
The second idea is Eloquent, the part that talks to the database. One model class both describes a table and reads and writes its rows. This is pleasant right up to the moment it isn't: writing $post->author inside a loop looks like reading a property and is actually a database query each time, so a page that is fine on ten test rows fires hundreds of queries in production. The cure is to load the relationship up front, and the framework can be told to throw an error in development when you forget.
The third idea is that the conveniences do not remove responsibility. Validation has to happen on the server even though the browser also checked. A logged-in user still needs a policy check before touching a specific record, because authentication only says who they are, not what they may do. And a queue worker, the process that runs deferred jobs, keeps the whole application in memory between jobs, so it leaks memory if left alone and ignores your new code until you restart it.
The surprise, if there is one, is that "batteries included" is a trade. The happy path is fast because nothing forces you to name what a class depends on, and that same freedom is what makes a large, old Laravel codebase hard to follow. Teams that stayed sane moved logic into small, explicit classes before it hurt.
Start with the Intro for the whole map. Slides give you the relationships between the parts, the Cheatsheet has the commands and the decision rules, and Practice is a compact project loop. The Exercise walks one article from route to form request to model to redirect to test. Field Notes carries the judgment that the reference pages leave out, and the Reference tab is your route into the official documentation once the shape is clear.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://laravel.com/docs/13.x/lifecycle
Supports
- Single entry point at public/index.php and the Composer autoloader
- Application and service container created from bootstrap/app.php
- HTTP and console kernels, bootstrappers, and the middleware stack
- Service providers, the register method, and the boot method ordering
- Router dispatching to a route or controller and running route middleware
- Response travelling back out through middleware and being sent to the browser
- https://laravel.com/docs/13.x/container
Supports
- The service container performs dependency injection through constructors
- Zero-configuration resolution for classes depending only on concrete classes
- bind produces a new instance, singleton produces one shared instance
- Binding an interface to an implementation
- Controllers, middleware, jobs, and listeners are resolved by the container
- The make method and the app helper
- https://laravel.com/docs/13.x/providers
Supports
- Service providers register and configure framework components
- register binds services, boot runs after all bindings exist
- AppServiceProvider as the place for application bindings
- bootstrap/providers.php lists active providers
- https://laravel.com/docs/13.x/facades
Supports
- A facade is a static-style proxy to a container-resolved service
- Facades use __callStatic to forward calls to a resolved instance
- Facades remain testable because the underlying object can be swapped
- Facades do not declare a dependency in a constructor
- https://laravel.com/docs/13.x/routing
Supports
- Routes defined in routes/web.php and routes/api.php
- Routes are checked in order
- Route parameters in braces are passed to the handler
- Route model binding resolves a model or returns a 404
- Named routes and URL generation with the route helper
- Route groups apply middleware to several routes
- Route::resource registers the seven CRUD routes
- Rate limiting is applied to API routes
- https://laravel.com/docs/13.x/middleware
Supports
- Middleware inspects and filters HTTP requests entering the application
- Before and after middleware behavior
- Global middleware, route middleware, and middleware aliases in bootstrap/app.php
- The web and api middleware groups and their default contents
- The web group includes session state and request-forgery protection
- make:middleware generates a middleware class
- https://laravel.com/docs/13.x/eloquent
Supports
- Eloquent is an active record object-relational mapper
- Model to plural snake_case table, id primary key, created_at and updated_at
- Retrieving, creating, updating, saving, and deleting models
- Queries return Eloquent collections
- Mass assignment and the $fillable allowlist
- https://laravel.com/docs/13.x/eloquent-relationships
Supports
- Relationships declared as methods hasOne, hasMany, belongsTo, belongsToMany
- Polymorphic and hasManyThrough relationships
- Reading an unloaded relationship triggers an additional query
- The N+1 query problem and its scale with the number of rows
- Eager loading with with() reduces N+1 to two queries
- load() for lazy eager loading after retrieval
- Model::preventLazyLoading() throws on an unloaded relationship access
- https://laravel.com/docs/13.x/migrations
Supports
- Migrations are versioned, reversible database schema changes
- up applies a change, down reverses it, using the Schema builder
- migrate, migrate:rollback, migrate:fresh, migrate:status
- Reviewing migrations before applying them to databases with real data
- migrate --force is required outside local environments
- https://laravel.com/docs/13.x/blade
Supports
- Blade templates are compiled to plain PHP and cached
- Double-brace output is escaped with htmlspecialchars against XSS
- The raw syntax outputs unescaped HTML for trusted content only
- Directives such as if, foreach, forelse, auth
- Components invoked as x-name with slots and attributes
- Layout inheritance with extends, section, and yield
- https://laravel.com/docs/13.x/validation
Supports
- The validate method on the request with a rules array
- Failure redirects back with errors and old input, or returns 422 JSON
- Form request classes with rules and authorize methods
- Form requests run automatically when type-hinted in a controller
- validated() returns only fields with declared rules
- The $errors message bag and the @error directive in Blade
- Server-side validation as the trust boundary
- The bail rule stops validation of a field on first failure
- https://laravel.com/docs/13.x/authorization
Supports
- Authorization is distinct from authentication
- Gates are closures for model-independent checks
- Policies group authorization rules for one model
- make:policy and policy method discovery
- Authorizing via the user model can method, the authorize helper, the can middleware, and the @can directive
- Gates and policies return false for unauthenticated requests by default
- https://laravel.com/docs/13.x/authentication
Supports
- The auth middleware rejects unauthenticated requests
- A successful login does not imply authorization for a specific record
- https://laravel.com/docs/13.x/starter-kits
Supports
- React, Vue, Svelte, and Livewire starter kits scaffold auth and a dashboard
- Starter kits use Laravel Fortify for authentication
- Registration, login, password reset, email verification, and two-factor authentication
- Applications are created with the Laravel installer, laravel new
- The JavaScript starter kits use Inertia
- https://laravel.com/docs/13.x/queues
Supports
- A queue defers slow work out of the request cycle
- Connections and drivers sync, database, redis, sqs in config/queue.php
- Job classes implement ShouldQueue and are created with make:job
- Dispatching a job onto a connection and queue
- queue:work runs a long-running worker; queue:listen reloads code each job
- A queue:work worker boots the application once and keeps it in memory
- New code is not used until queue:restart
- Workers run under a process manager such as Supervisor, or Horizon for Redis
- --max-jobs and --max-time bound a worker's lifetime
- Jobs that exhaust retry attempts land in the failed_jobs table
- https://laravel.com/docs/13.x/csrf
Supports
- Laravel generates a CSRF token per session
- The PreventRequestForgery middleware is in the web group
- POST, PUT, PATCH, and DELETE requests are checked
- The @csrf directive outputs the hidden _token field
- X-CSRF-TOKEN and X-XSRF-TOKEN headers for JavaScript clients
- https://laravel.com/docs/13.x/encryption
Supports
- Encrypted cookies and the APP_KEY requirement
- https://laravel.com/docs/13.x/hashing
Supports
- Passwords are stored hashed, not in plain text
- https://laravel.com/docs/13.x/deployment
Supports
- Server requirements and PHP-FPM behind Nginx or Apache
- config:cache and route:cache as optimization steps
- APP_DEBUG must be false in production
- The built-in development server is for development only
- https://laravel.com/docs/13.x/queries
Supports
- The query builder uses PDO parameter binding to prevent SQL injection
- https://laravel.com/docs/13.x/eloquent-collections
Supports
- Query results are returned as Eloquent collection objects with helpers
- https://laravel.com/docs/13.x/testing
Supports
- Laravel test tools issue HTTP requests and use a separate test database
- CSRF middleware is disabled during tests
- https://laravel.com/docs/13.x/artisan
Supports
- Artisan is Laravel's command-line interface
- artisan list, make commands, tinker, about, route:list
- https://laravel.com/docs/13.x/installation
Supports
- Installing PHP, Composer, and the Laravel installer
- Creating a new application and the default directory layout
- https://bootcamp.laravel.com/
Supports
- An official guided build of a small Laravel application
- https://laravel.com/docs/13.x/releases
Supports
- Laravel follows semantic versioning with a major release each year in Q1
- Bug fixes for 18 months and security fixes for 2 years
- Laravel 10 released February 14th 2023
- Laravel 11 released March 12th 2024
- Laravel 12 released February 24th 2025
- Laravel 13 released March 17th 2026, requires PHP 8.3
- Minor and patch releases never contain breaking changes
- Middleware and configuration are set in bootstrap/app.php
- https://en.wikipedia.org/wiki/Laravel
Supports
- Taylor Otwell created Laravel as an alternative to CodeIgniter, which lacked built-in authentication
- Laravel 1 released June 2011
- Laravel 3 released February 22 2012 with Artisan, migrations, and Bundles
- Laravel 4 released May 28 2013, rewritten as Composer packages
- Laravel 5.0 released February 4 2015
- Laravel 5.1 released June 9 2015 as the first LTS
- Lumen released in 2015 as a lightweight derivative
- Laravel 5.5 released August 30 2017 with package auto-discovery
- Laravel 6 released September 3 2019, introduced semantic versioning
- Laravel 8 released September 8 2020
- Laravel 9 released February 8 2022, began the annual cadence
- Laravel 11 bundled the Reverb WebSocket server
- https://themsaid.com/avoiding-memory-leaks-when-running-laravel-queue-workers
Supports
- A queue worker boots the application once and keeps it in memory across jobs
- References accumulate in a long-running worker and can crash the server
- Code changes require a manual queue:restart
- Periodic worker restarts with --max-jobs and --max-time mitigate leaks
- https://laravel-news.com/laravel-n1-query-problems
Supports
- Eloquent's readable relationship syntax hides per-access queries
- N+1 problems commonly pass unnoticed in development on small datasets
- Eager loading and preventLazyLoading as the standard responses
- https://laravel.com/
Supports
- Laravel is an open-source full-stack PHP framework
- https://symfony.com/
Supports
- Symfony is a full-stack PHP framework and a set of reusable components
- https://codeigniter.com/
Supports
- CodeIgniter is a small-footprint PHP framework
- https://wordpress.org/
Supports
- WordPress is an open-source PHP content management and publishing platform
- https://statamic.com/
Supports
- Statamic is a content management system built as a Laravel package
- https://livewire.laravel.com/
Supports
- Livewire builds reactive interface components driven from PHP and Blade
- https://inertiajs.com/
Supports
- Inertia connects Laravel controllers to React, Vue, or Svelte without a separate API
- https://filamentphp.com/
Supports
- Filament builds admin panels from Eloquent models
- https://nova.laravel.com/
Supports
- Laravel Nova is the first-party paid administration panel
- https://cloud.laravel.com/
Supports
- Laravel Cloud is a managed deployment platform for Laravel applications
- https://forge.laravel.com/
Supports
- Laravel Forge provisions and manages servers for Laravel applications
- https://vapor.laravel.com/
Supports
- Laravel Vapor runs Laravel on AWS Lambda in a serverless model
- https://pestphp.com/
Supports
- Pest is a testing framework built on PHPUnit with Laravel support
- https://github.com/larastan/larastan
Supports
- Larastan adds Laravel-aware static analysis on top of PHPStan
- https://github.com/barryvdh/laravel-debugbar
Supports
- Laravel Debugbar shows queries, timings, and views per request
- https://github.com/barryvdh/laravel-ide-helper
Supports
- Laravel IDE Helper generates editor metadata for facades and models
- https://spatie.be/open-source
Supports
- Spatie maintains a large catalog of Laravel packages including permissions and media handling
- https://laravel-news.com/
Supports
- Laravel News covers releases, packages, and tutorials
- https://laraveldaily.com/
Supports
- Laravel Daily publishes practical Laravel tutorials and courses
- https://laravelshift.com/
Supports
- Laravel Shift automates framework upgrade pull requests
- https://backpackforlaravel.com/
Supports
- Backpack is an admin CRUD framework for Laravel
- https://laracasts.com/
Supports
- Laracasts is a Laravel video training library
