PHP Development UK: Custom PHP Applications, Upgrades and Rescues

PHP has been our core language since the start

Most of dijitul's development history is written in PHP. Our early bespoke work included automated billing software, first built to invoice customers for electricity, water and gas usage, and staff target management software. On the ecommerce side we wrote OpenCart extensions, CubeCart mods, WP e-Commerce plugins and the KashFlow integrations that connected them to accounts. All PHP.

That gives us a useful perspective. We have written PHP the old way and the new way, and we know how to move a system from one to the other without breaking the business that relies on it.

Modern PHP is a different language

If your picture of PHP is from 2010, modern PHP will surprise you. PHP 8 brought a JIT compiler, union types, named arguments, attributes, enums, readonly properties, match expressions and first-class callable syntax. Combined with today's tooling, it supports well-structured, testable applications:

• Composer for dependency management and autoloading.
• PSR standards for coding style, autoloading, HTTP messages and logging, so libraries fit together.
• PHPStan or Psalm for static analysis that catches type errors before runtime.
• Pest or PHPUnit for automated tests.
• Rector for automated refactoring and version upgrades.
• Laravel and Symfony for full application frameworks.

For new projects we usually choose Laravel. For projects extending an existing Symfony codebase, or where Symfony's components fit better, we use Symfony.

PHP versions: where you need to be

The PHP project supports each release for two years of active support and two further years of security fixes. According to php.net:

If your application is on PHP 8.2 or earlier, it is now, or will be within weeks, running without security fixes. That matters for PCI DSS, for cyber insurance questionnaires and for Cyber Essentials. See PHP upgrade and modernisation.

Working with legacy PHP

Much of our PHP work is on systems someone else wrote: a bespoke order system from 2012, a members' area built on an abandoned framework, or a mix of procedural scripts that run the business. We do not recommend rewrites by default. The usual approach is:

1. Get the code into Git and a copy running locally and on staging.
2. Add characterisation tests around the most important behaviour so we know if we break it.
3. Upgrade PHP step by step, fixing removed functions, stricter typing and deprecated dynamic properties.
4. Fix security issues such as unparameterised SQL queries, unescaped output and weak password hashing.
5. Refactor the worst areas into structured, tested code, one piece at a time.

Sometimes a rewrite really is cheaper. If so, we will show you why. See legacy software modernisation.

Speed and security in PHP applications

Slow PHP applications are rarely slow because of PHP. In our experience the time goes on database queries without indexes, the same query run hundreds of times in a loop, external API calls made while the user waits, and missing caching. We profile real requests, then fix the biggest costs first: adding indexes, eager loading related records, moving slow work into queues, and caching results in Redis. OPcache is configured properly on the server, which on its own often gives a noticeable gain.

Security reviews follow the OWASP Top 10. In older PHP code the usual findings are SQL built by joining strings, output printed without escaping, passwords stored with MD5 or SHA1 instead of password_hash(), missing CSRF tokens on forms and file uploads that are not checked. Each one is fixable, and fixing them is usually far cheaper than dealing with a breach.

Starting a PHP project

Whether you need a new application, an upgrade, a rescue or an integration, we start with a free chat. For existing systems we usually review the code first and give you an honest summary. You then get a fixed-price quote for an agreed scope, with larger work split into phases. You own all the code. Get in touch.

What we deliver

• New PHP 8 applications in Laravel or Symfony
• Upgrades of legacy PHP code to supported versions, with tests added
• Refactoring of procedural PHP into maintainable, structured code
• Integrations with accounting, payment and CRM APIs
• Performance work: query optimisation, caching, OPcache tuning
• Security reviews and fixes for SQL injection, XSS and authentication flaws

How it works and what it costs

Every project gets a fixed-price quote after a free initial chat and a short scoping stage. You own the code and the data.

1. Free chat

   Tell us the problem in plain English: what you do now, what goes wrong and what "better" looks like. No charge, no obligation.

2. Scoping

   We map the processes, systems and data involved, agree what is in and out, and write it down so there are no surprises.

3. Fixed-price quote

   You get a fixed price for the agreed scope, or a phased plan for bigger builds, so you can start small and prove it works.

4. Build and test

   We build in short stages you can see and try, test against real data, then go live carefully with a rollback plan.

5. Hand over and look after

   You own the code and the data. We can host it, support it and keep improving it, or hand it to your own team.

Related