Laravel 5-Year Interview (Q1–25)

Solution and explanation

• One of the most important questions for a 5-year developer.
• For GET /api/products:

Web Server
    ↓
public/index.php
    ↓
Application Bootstrap
    ↓
Service Providers
    ↓
HTTP Kernel / Middleware Pipeline
    ↓
Router
    ↓
Route Middleware
    ↓
Controller
    ↓
Service
    ↓
Database
    ↓
Response
    ↓
Middleware
    ↓
HTTP Response

• public/index.php is the entry point; it loads bootstrap/app.php, creates the application and sends the request through the HTTP kernel.

$app = require_once __DIR__.'/../bootstrap/app.php';

• Interview tip: don't just say "the route calls the controller".
• Walk through web server, index.php, bootstrap, service providers, middleware, router, controller, business logic, database and response.

Solution and explanation

• web.php is for browser routes and runs the web middleware group: sessions, cookies and CSRF protection.

Route::get('/products', fn () => view('products'));

• api.php is for stateless HTTP APIs.
• Its routes are prefixed with /api and usually authenticate with tokens (for example Sanctum) instead of sessions.
• In Laravel 11+ the file is added with php artisan install:api.

Route::get('/products', [ProductController::class, 'index']);

• Typical API routes:

GET    /api/products
POST   /api/products
PUT    /api/products/{id}
DELETE /api/products/{id}

Solution and explanation

• Artisan is Laravel's command-line interface.

php artisan migrate
php artisan make:model Product
php artisan make:controller ProductController
php artisan make:migration create_products_table
php artisan queue:work
php artisan optimize
php artisan route:list

• Custom command:

php artisan make:command ImportCompanies

class ImportCompanies extends Command
{
    protected $signature = 'companies:import';

    public function handle(): int
    {
        // import logic
        return self::SUCCESS;
    }
}

php artisan companies:import

Solution and explanation

• Eloquent is Laravel's ORM (Object Relational Mapping).
• Instead of SQL like SELECT * FROM products WHERE id = 10 you write:

$product = Product::find(10);

Product::create(['name' => 'Samsung A35', 'price' => 30000]);

$product->update(['price' => 28000]);

$product->delete();

Solution and explanation

// Eloquent
Product::where('price', '>', 10000)->get();

// Query Builder
DB::table('products')->where('price', '>', 10000)->get();

• Eloquent advantages: models, relationships, attribute casting, accessors, mutators, events, scopes and convenient syntax.

• Query Builder advantages: lightweight, good for complex queries and reporting, and no model hydration overhead.

• Interview answer: "I prefer Eloquent when relationships and model behavior matter.
• For heavy reporting, aggregations or highly optimized queries, Query Builder or raw SQL can be more appropriate."

Solution and explanation

• Passing a whole request array into create() or update().

User::create($request->all());

• A malicious user might submit:

{ "name": "Sachin", "email": "test@test.com", "is_admin": true }

• If is_admin is mass assignable, the user could escalate privileges.
• Protect models with $fillable (allow-list) or $guarded (block-list):

protected $fillable = ['name', 'email'];

• Best practice: use an explicit $fillable on important models and pass only validated data, for example User::create($request->validated()).

Solution and explanation

• $fillable lists the fields that can be mass assigned. $guarded lists the fields that cannot.

protected $fillable = ['name', 'email', 'phone'];   // allow-list

protected $guarded = ['is_admin'];                  // block-list

• For security-sensitive applications explicit allow-listing ($fillable) is preferable: a new column is protected by default until you deliberately allow it.

Solution and explanation

• Migrations are version-controlled database schema definitions.

php artisan make:migration create_products_table

Schema::create('products', function (Blueprint $table) {
    $table->id();
    $table->string('name');
    $table->decimal('price', 10, 2);
    $table->timestamps();
});

php artisan migrate
php artisan migrate:rollback
php artisan migrate:refresh
php artisan migrate:fresh

rollback undoes the latest migration batch. refresh rolls back every migration and runs them again. fresh drops all tables and migrates from scratch.

• Warning: refresh and fresh delete data.
• Never run them against production or a shared database; use new forward-only migrations there.

Solution and explanation

• Seeders insert initial or test data.
• Migrations define structure; seeders define data.

php artisan make:seeder ProductSeeder

Product::create(['name' => 'Samsung A35', 'price' => 30000]);

php artisan db:seed
php artisan db:seed --class=ProductSeeder

• Production tip: write seeders with updateOrCreate() so running them twice does not create duplicates.

Solution and explanation

• Factories generate fake data for tests and development.

php artisan make:factory ProductFactory

public function definition(): array
{
    return [
        'name' => fake()->words(3, true),
        'price' => fake()->randomFloat(2, 100, 50000),
    ];
}

Product::factory()->count(100)->create();

• Useful for testing, local development, load testing and database seeding.