2026 年 PHP 开发者应停止使用的坏实践 ​

// ❌ Please, no.
$result = @file_get_contents('https://some-api.com/data');

// ✅ Handle it properly
$result = file_get_contents('https://some-api.com/data');

if ($result === false) {
    throw new \RuntimeException('Failed to fetch data from API');
}

use GuzzleHttp\Client;
use GuzzleHttp\Exception\RequestException;

$client = new Client();

try {
    $response = $client->get('https://some-api.com/data');
    $body = $response->getBody()->getContents();
} catch (RequestException $e) {
    logger()->error('API call failed', ['error' => $e->getMessage()]);
    throw $e;
}

// ❌ SQL injection waiting to happen
$id = $_GET['id'];
$result = $pdo->query("SELECT * FROM users WHERE id = $id");

// ✅ Safe, modern, and actually readable
$pdo = new PDO('mysql:host=localhost;dbname=myapp', $user, $pass, [
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
]);

$stmt = $pdo->prepare('SELECT * FROM users WHERE id = :id');
$stmt->execute(['id' => $_GET['id']]);
$user = $stmt->fetch();

// ❌ The "God Controller" anti-pattern
class OrderController extends Controller
{
    public function store(Request $request)
    {
        // validate...
        // calculate totals manually...
        // update inventory...
        // send confirmation email...
        // log to 3 different places...
        // generate PDF invoice...
        // notify Slack...
    }
}

// ✅ Clean, testable, reusable
class OrderController extends Controller
{
    public function __construct(private OrderService $orderService) {}

    public function store(StoreOrderRequest $request): JsonResponse
    {
        $order = $this->orderService->createOrder($request->validated());

        return response()->json($order, 201);
    }
}

// The real work lives here, and it's actually testable
class OrderService
{
    public function createOrder(array $data): Order
    {
        $order = Order::create($data);
        $this->inventoryService->decrement($order);
        $this->mailer->sendConfirmation($order);

        return $order;
    }
}

// ❌ What even goes in here? What comes out?
function processPayment($amount, $currency, $user) {
    // mystery box
}

// ✅ Self-documenting and safe
function processPayment(
    float $amount,
    string $currency,
    User $user
): PaymentResult {
    // Now we know exactly what this does
}

// ✅ No more magic strings like 'pending', 'active', 'cancelled'
enum OrderStatus: string
{
    case Pending   = 'pending';
    case Active    = 'active';
    case Cancelled = 'cancelled';
}

function updateStatus(Order $order, OrderStatus $status): void
{
    $order->update(['status' => $status->value]);
}

// ❌ 2009 called
require_once 'libs/phpmailer/PHPMailer.php';
require_once 'libs/guzzle/guzzle.php';

// ✅ Clean autoloading, version-locked, reproducible builds
use Symfony\Component\Mailer\Mailer;
use GuzzleHttp\Client;

// ❌ This is not error handling, this is giving up
$user = getUser($id) or die('User not found');

// ✅ Throw, catch, log, respond
function getUser(int $id): User
{
    $user = User::find($id);

    if (!$user) {
        throw new UserNotFoundException("User with ID $id not found.");
    }

    return $user;
}

// In your controller or middleware:
try {
    $user = getUser($id);
} catch (UserNotFoundException $e) {
    return response()->json(['error' => $e->getMessage()], 404);
}

// A basic feature test — takes 5 minutes, saves hours of debugging
public function test_user_can_place_an_order(): void
{
    $user    = User::factory()->create();
    $product = Product::factory()->create(['stock' => 10]);

    $response = $this->actingAs($user)
        ->postJson('/api/orders', ['product_id' => $product->id, 'quantity' => 2]);

    $response->assertStatus(201);
    $this->assertDatabaseHas('orders', ['user_id' => $user->id]);
    $this->assertEquals(8, $product->fresh()->stock);
}