DevFoundry/.devfoundry/rules/php.md

Rules: PHP

1. Data Access: Use PDO with prepared statements for all queries. Never interpolate raw user input into SQL strings.
2. Strict Types: Use declare(strict_types=1); in new files where the codebase allows it.
3. Error Handling: Use exceptions and centralized error/logging handlers instead of @ error suppression.
4. Legacy Compatibility: When editing legacy PHP (pre-7 style), preserve existing patterns unless the spec explicitly calls for modernization.
5. TDD: Write the PHPUnit (or Pest) test first, run it and confirm it fails for the right reason, then implement the minimum code to pass it. Do not write production code without a preceding failing test.
6. Architecture: New or substantially modified web apps follow an MVC structure (e.g., Laravel's built-in MVC, or an explicit controllers/models/views split for framework-less code) — no SQL or business logic inline in view templates.
7. Design by Contract: Public functions/methods validate their preconditions at entry (type checks, argument validation) and throw a typed exception on violation rather than continuing on bad input; state postconditions in a docblock or the spec's Technical Design section.