Back-end language · in regular use
PHP agency in Nice
The language behind a large share of the business web, and the basis of Laravel and Symfony.
What we do with it
PHP at our clients, concretely
Used on internal software in Symfony, on a management package for a school, and on the interfaces of a network quality testing tool. It is also the language of the script handling this site's contact form.
The limits
When we recommend something else
For a real-time or highly concurrent service, Node.js or Python fit better.
Our work
Projects we delivered with PHP
Paradigm
Platform for a Nice business centre: registered address, digitised mail, messaging and assistant.
PHP: Language of the Laravel back end, tested with Pest.
Read the Paradigm case studyHelioneo
Collective self-consumption platform: agreements, allocation keys, Enedis data and billing.
PHP: Platform language, with asynchronous Enedis processing.
Read the Helioneo case studyOrdelya
Restaurant management platform: back office, tablets, kiosks, screens and website.
PHP: WordPress plugin that syncs the menu to the restaurant's website.
Les Sens
Redesign of a Nice restaurant's website, in three languages, with online booking.
PHP: Bespoke WordPress theme: live opening hours, widgets and structured data.
Method
How we bring PHP into a project
We set up PHP projects with Composer, on a language version still receiving security fixes, and pin that version in the configuration so development and production stay identical. A Docker container reproduces the server environment on the developer's machine. For internal software meant to last, we start from an established framework, usually Symfony, with Doctrine for database access and versioned migrations recording every schema change.
Business code is kept apart from controllers: invoicing, enrolment or approval rules live in services tested with PHPUnit, independently of the display layer. PHPStan analyses the code on every change and PHP-CS-Fixer enforces a consistent style. For a simple server-side task, such as a contact form, a standalone PHP script is enough, with no framework or database.
Deployment runs through continuous integration: dependencies installed without development tools, migrations executed, then release to the hosting set up under your own credentials. Credentials and secrets stay in environment variables, never in the repository. The documentation lists the PHP version, the required extensions, any scheduled tasks and the steps for restoring the application on a new server.
For your business
What it changes in practice
For a small business, PHP's first effect is on day-to-day running. The application can run on most hosts, including the one you probably already use, and routine jobs such as sending emails or scheduled exports rely on mechanisms any administrator knows. You do not have to maintain special infrastructure for ordinary management software.
For your users, a well-built PHP application serves pages that arrive fully formed from the server: they stay usable on an older computer or a modest connection, which matters in a school or a workshop. In terms of continuity, the language is backed by a very large community and security fixes follow a known schedule, so planning upgrades becomes a line in the annual budget rather than an emergency. If you change supplier, code written in an established framework can be handed over without depending on the memory of whoever originally wrote it, and without you being tied to us in any way.
Our reading of it
What we take away from PHP
PHP carries a reputation earned by its version 5 era. Current releases have explicit typing, performance unrelated to that period, and a serious dependency manager. We no longer write PHP without a framework: Laravel supplies the structure, the database migrations and the tests that the bare language leaves to everyone’s discretion.
On hosting, it is still what deploys most easily with any provider, with MySQL as the default database in most shared plans. A good share of our PHP work is not new code either, but taking over an existing WordPress site: fixing a theme, securing a homegrown plugin, regaining control of what a predecessor left behind.
Decision guide
Should you choose PHP?
PHP or Node.js for the back end of internal management software?
For conventional management software (data entry, approval, access rights, exports, tables), PHP with Symfony or Laravel is a sound choice: both frameworks provide authentication, forms and database access out of the box. Node.js has the edge for a real-time or highly concurrent service, such as messaging or a continuous data stream. For request-by-request business processing, PHP remains simpler to run.
Symfony or Laravel for our PHP project?
Symfony suits applications expected to last and grow: its components are decoupled, its conventions strict, and its long-term support releases reassure an IT department. Laravel moves faster on a mid-sized project thanks to ready-made tooling for queues, email and authentication. We have used Symfony on internal software. If your team already knows one of the two, that outweighs every other consideration.
Is PHP a good fit if our hosting is shared or already in place?
Yes, and that is one of its practical strengths. PHP runs on almost every web host, shared plans included, with no long-running process to supervise. A Node.js or Python application usually needs a dedicated server or a container. For that kind of small server-side task, PHP avoids extra infrastructure altogether: the script handling this site's contact form is itself written in PHP.
Client questions
What clients ask us about PHP
Isn't PHP an outdated language?
That reputation comes from older versions. Modern PHP has type declarations, much better performance and structured frameworks such as Symfony and Laravel. It powers a large share of the business web, which means a wide pool of developers and continued development of the language. What ages badly is mostly applications left running on an old version.
Our application runs on an old PHP version: what are the risks?
Each PHP version stops receiving security fixes after a few years. Beyond that point, any newly discovered vulnerability stays open, and some hosts eventually remove those versions from their servers. Upgrading means checking for removed functions and incompatible libraries. We start with a code audit to identify what stands in the way before making any change.
Could another supplier take over our PHP application?
Yes, particularly if it is built on Symfony or Laravel: their conventions show where everything lives, and developers who know them are plentiful. A PHP application written without a framework, organised to its author's own habits, takes longer to hand over. That is why we rely on an established framework for any software meant to last.
Can PHP serve as an API for a React interface or a mobile app?
Yes. Symfony and Laravel are well suited to exposing an API that returns JSON data, with token authentication and generated OpenAPI documentation. The React interface or mobile app then consumes that API like any other service. Keeping them separate lets you change the screens without touching business rules, and add a second client later, such as a partner portal, on the same foundations.
How do you protect a PHP application against common attacks?
Frameworks such as Symfony deal with several risks out of the box: prepared statements against SQL injection, automatic escaping in templates, tokens against cross-site request forgery, and password hashing. We add checks for vulnerable dependencies with Composer, access rights enforced on the server and a production configuration that hides error messages. The rest comes down to applying updates regularly.
Going further
PHP sits within our Software development
A technology does not make a project. The method around it decides the outcome: scoping, prototypes, short cycles, and a clean way out.
Neighbouring technologies
A PHP project in mind?
The first conversation is free. We will tell you plainly whether this technology is the right one, and if not, which is.
Updated on