Laravel interview questions

Laravel is a PHP web framework that follows the MVC pattern. It gives you routing, an ORM (Eloquent), templating (Blade), authentication, queues, caching and testing out of the box, so you write business logic instead of plumbing. It has a large ecosystem (Forge, Vapor, Livewire, Sanctum) and a strong community.

1. The web server sends the request to public/index.php.
2. It loads Composer's autoloader and creates the application (bootstrap/app.php).
3. The HTTP kernel runs global middleware, then the router matches the route.
4. Route middleware runs, then the controller or closure.
5. The response travels back out through the middleware and is sent to the browser.

It holds environment-specific settings (database credentials, APP_KEY, mail settings) outside the code, so each environment can differ and secrets are not committed. Config files read it with env(); in application code you use config(), because env() returns null once the config is cached.

It caches the configuration, routes, events and views (config:cache, route:cache, event:cache, view:cache) so Laravel does less work per request in production. Run php artisan optimize:clear after changing .env or config.

Service providers are where the application is bootstrapped: they register bindings in the service container (register()) and set things up after everything is registered (boot()), such as event listeners, routes or view composers. Laravel's own features are loaded through providers too.

Laravel turns a route parameter into a model automatically. With Route::get('/posts/{post}', ...) and a Post $post argument, Laravel finds the post by id (or another column with {post:slug}) and returns 404 if it doesn't exist.

Middleware filters HTTP requests before (or after) they reach the controller. Examples: auth redirects guests to the login page, throttle rate-limits requests, verified requires a verified email. You can write your own, e.g. to block banned users.

A resource controller has the seven CRUD methods (index, create, store, show, edit, update, destroy) registered with Route::resource(). A single action controller has only __invoke() and handles one route, which keeps big actions in their own class.

Call $request->validate([...]) in the controller, or create a Form Request (php artisan make:request) with rules() and authorize(). On failure Laravel redirects back with errors (or returns 422 JSON for API requests). Use $request->validated() to get only the validated data.

A named route has a name (->name('posts.show')) so you generate URLs with route('posts.show', $post) instead of hard-coding paths. If the URL changes later, every link still works.

Eloquent is Laravel's ORM: each database table has a model class, and rows become objects. You query with a fluent API (User::where('active', true)->get()), define relationships as methods, and get features such as casts, accessors, events and soft deletes.

Looping over 50 posts and reading $post->author runs 1 query for the posts plus 50 for the authors. Fix it with eager loading: Post::with('author')->get() runs 2 queries in total. Model::preventLazyLoading() in development makes Laravel throw when it happens.

• hasOne / belongsTo: one to one (user has one profile).
• hasMany / belongsTo: one to many (post has many comments).
• belongsToMany: many to many through a pivot table (posts and tags).
• hasManyThrough / hasOneThrough: reach a relation through another model.
• morphTo / morphMany: polymorphic, one model belongs to several types (comments on posts and videos).

$fillable lists the attributes that may be mass assigned with create() or fill(); $guarded lists the ones that may not. They protect against users setting fields like is_admin through a form. Use one of them, not both.

Migrations are version control for the database schema: PHP classes that create or change tables, run with php artisan migrate and shared through Git. Seeders fill tables with data (demo or required rows), often using model factories.

Reusable query constraints on a model. A local scope like scopePublished($query) (or a method with the #[Scope] attribute) is used as Post::published()->get(). A global scope is applied to every query of the model automatically, e.g. soft deletes.

Wrap related writes in DB::transaction(function () { ... }). If an exception is thrown, everything is rolled back; otherwise it's committed. Use them when several writes must succeed or fail together, like an order and its payment.

All three avoid loading a huge table into memory. chunk() / chunkById() run one query per batch and give you a collection per batch. lazy() does the same but yields one model at a time. cursor() runs a single query and streams rows, using the least memory but no eager loading. Prefer chunkById() / lazyById() when you update rows while looping.

It's Laravel's dependency injection container: it knows how to build classes and their dependencies. When a controller asks for PaymentGateway $gateway in its constructor or method, the container creates it (and its dependencies) automatically.

bind() creates a new instance every time it's resolved. singleton() creates one instance and reuses it for the whole application lifetime. scoped() is one instance per request or job, which matters with Octane and queue workers where the app lives across requests.

Facades give a static-looking API (Cache::get()) to services in the container. Behind the scenes, the facade class resolves the real object from the container and forwards the call, so they stay testable: Cache::shouldReceive(...) swaps in a mock.

Keep controllers thin: validate, call a service or action class, return a response. Put business rules in service or action classes, side effects in events / listeners and jobs, and authorization in policies. Group code by feature (domain) as the app grows.

To move slow work (emails, image processing, API calls) out of the web request. The user gets a fast response and a worker (php artisan queue:work) runs the job in the background, with retries and failure handling.

Laravel retries it up to $tries times, waiting backoff() seconds between attempts. After the last attempt it calls the job's failed() method and stores it in the failed_jobs table, where you can retry it with php artisan queue:retry.

An event says something happened (OrderShipped); listeners react to it (send an email, update stock). This decouples the code that causes something from the code that reacts. Listeners can be queued with ShouldQueue.

You define scheduled tasks in routes/console.php (or the console kernel in older versions), e.g. Schedule::command('reports:send')->dailyAt('08:00'). On the server, one cron entry runs php artisan schedule:run every minute and Laravel decides what is due.

Each session has a CSRF token. Forms include it with @csrf and the CSRF middleware (ValidateCsrfToken, called VerifyCsrfToken before Laravel 11) rejects POST, PUT, PATCH and DELETE requests without a matching token (419 Page Expired). APIs that use tokens instead of cookies don't need it.

Eloquent and the query builder use prepared statements, so values are escaped; only raw methods (DB::raw, whereRaw) with user input are risky. Blade's {{ }} escapes output against XSS; {!! !!} doesn't, so use it only for trusted HTML.

Both handle authorization. A gate is a closure for a single action (Gate::define('view-reports', ...)). A policy is a class grouping the rules for one model (PostPolicy with update, delete). Check them with can(), @can or $this->authorize().

Sanctum is the simple option: API tokens for mobile apps and cookie-based auth for your own SPA. Passport is a full OAuth2 server, needed when third-party apps must get access to your users' data. Most apps only need Sanctum.

Feature tests send HTTP requests through the whole app ($this->get('/posts')->assertOk()), including middleware and the database. Unit tests check a single class in isolation. Most Laravel test suites are mostly feature tests because they catch real bugs.

Use the fakes: Mail::fake(), Queue::fake(), Event::fake(), Http::fake(), Storage::fake(). They record calls instead of performing them, so you assert with Mail::assertSent(...) or Queue::assertPushed(...).

• Measure first (Telescope, Debugbar, slow query log).
• Fix N+1 queries with eager loading; add database indexes.
• Cache expensive queries and results (Redis).
• Move slow work to queues.
• In production run php artisan optimize, enable OPcache, and consider Octane.

Octane keeps the application in memory between requests using a long-running server (FrankenPHP, Swoole or RoadRunner), so the framework doesn't boot on every request. It's much faster, but you must avoid state leaking between requests (static properties, singletons holding request data).