Laravel interview questions

What a strong answer covers

• Define MVC: Model (data/business logic), View (presentation), Controller (request handling/orchestration).
• Explain how Laravel implements each component: Eloquent Models, Blade Templates, and Controller classes.
• Describe the flow of a request through MVC in Laravel: Route -> Controller -> Model (interacts with DB) -> Controller -> View -> Response.
• Highlight benefits: separation of concerns, improved maintainability, easier testing.

Where people lose the point

• ×Confusing the roles of Model and Controller, e.g., putting database queries directly in controllers without using Eloquent.
• ×Not mentioning how Laravel specifically implements MVC (e.g., Eloquent, Blade).
• ×Failing to explain the request flow through the components in a logical sequence.

What a strong answer covers

• Explain that routes map URLs to controller actions or closures, typically defined in `routes/web.php` or `routes/api.php`.
• Demonstrate defining a basic GET route using `Route::get('/uri', 'Controller@method')` or a closure.
• Define route parameters as dynamic segments in the URL, often enclosed in curly braces `{}`.
• Show an example of a route with a required parameter and how to access it in the controller/closure.

Where people lose the point

• ×Forgetting to specify the HTTP verb (GET, POST, etc.) for the route.
• ×Incorrectly defining route parameters or failing to explain their purpose.
• ×Not mentioning the common route files (`web.php`, `api.php`).

What a strong answer covers

• Explain that Eloquent models represent database tables and provide an object-oriented interface.
• Show how to create a new record: `Model::create(['column' => 'value'])` or `new Model(); $model->save();`.
• Demonstrate reading records: `Model::all()`, `Model::find(id)`, `Model::where('column', 'value')->get()`.
• Illustrate updating a record: `$model->update(['column' => 'new_value'])` or `$model->column = 'new_value'; $model->save();`.
• Explain deleting a record: `$model->delete()` or `Model::destroy(id)`.

Where people lose the point

• ×Mixing raw SQL queries with Eloquent examples, indicating a lack of understanding of ORM.
• ×Forgetting to mention `fillable` or `guarded` for mass assignment when using `create()` or `update()`.
• ×Providing incomplete or incorrect syntax for CRUD operations.

What a strong answer covers

• Define middleware as a mechanism for filtering HTTP requests entering your application.
• Explain that middleware can inspect, modify, or even reject requests before they reach the route/controller.
• Provide examples of built-in middleware (e.g., `Auth`, `VerifyCsrfToken`, `TrimStrings`).
• Give a concrete use case for custom middleware, such as logging user activity, checking API keys, or enforcing specific headers.

Where people lose the point

• ×Confusing middleware with service providers or event listeners.
• ×Failing to explain *when* middleware executes in the request lifecycle.
• ×Providing a vague example without a clear problem/solution.

What a strong answer covers

• Define the Service Container as a powerful tool for managing class dependencies and performing dependency injection.
• Explain dependency injection (DI): providing dependencies to a class rather than the class creating them itself.
• Describe how the container automatically resolves and injects dependencies when type-hinted in constructors or methods.
• Highlight benefits: loose coupling, improved testability, easier maintenance, and adherence to SOLID principles.

Where people lose the point

• ×Confusing the Service Container with a simple global registry or a service provider.
• ×Failing to explain *how* DI works with type-hinting in Laravel.
• ×Not articulating the benefits of DI beyond just 'making things easier'.

What a strong answer covers

• Explain Blade as Laravel's templating engine that compiles to plain PHP and offers zero overhead.
• List and describe common directives: `@extends` (layout inheritance), `@section` (content definition), `@include` (partial views), `@if`/`@else` (conditionals), `@foreach` (loops).
• Explain how Blade improves view development by providing a clean, expressive syntax for common tasks.
• Mention benefits like code reusability, readability, and separation of concerns.

Where people lose the point

• ×Confusing Blade directives with raw PHP syntax without explaining the abstraction.
• ×Not mentioning the compilation aspect of Blade and its performance implications.
• ×Failing to provide concrete examples of how directives are used.

What a strong answer covers

• Define authentication: verifying who a user is (e.g., login credentials).
• Define authorization: determining what an authenticated user is allowed to do.
• Explain Laravel's authentication implementation: starter kits (Breeze/Jetstream), `Auth` facade, guards, and user providers.
• Describe Laravel's authorization implementation: Gates (simple closures) and Policies (classes for model-specific logic).

Where people lose the point

• ×Confusing the two concepts or using them interchangeably.
• ×Not mentioning specific Laravel features for each (e.g., `Auth` facade for auth, Gates/Policies for authz).
• ×Failing to explain the practical use cases for both.

What a strong answer covers

• Explain the concept of relationships in Eloquent for connecting models based on database table relationships.
• Describe and provide code examples for 'one-to-one' (`hasOne`, `belongsTo`).
• Describe and provide code examples for 'one-to-many' (`hasMany`, `belongsTo`).
• Describe and provide code examples for 'many-to-many' (`belongsToMany`), including the pivot table concept.

Where people lose the point

• ×Incorrectly defining the methods for each relationship type (e.g., `hasOne` vs `belongsTo`).
• ×Failing to explain the underlying database foreign key structure for each relationship.
• ×Not mentioning the pivot table for many-to-many relationships.

What a strong answer covers

• Define the N+1 query problem: fetching a collection of models, then iterating over them and executing a separate query for each related model.
• Explain why it's a performance issue (N+1 database queries instead of 2).
• Demonstrate an example scenario where the N+1 problem would occur.
• Explain and show how to solve it using eager loading with the `with()` method on the initial query.

Where people lose the point

• ×Misidentifying the problem or its cause.
• ×Suggesting inefficient solutions like caching individual related models instead of eager loading.
• ×Not providing a clear code example of both the problem and its solution.

What a strong answer covers

• Start with `public/index.php` as the entry point, bootstrapping the application.
• Explain the role of the HTTP kernel (`App\Http\Kernel`) in handling the request and passing it through global middleware.
• Describe routing: matching the incoming URL to a defined route and dispatching it to a controller action or closure.
• Mention route-specific middleware, controller execution (interacting with models, services), and view rendering (Blade).
• Conclude with the HTTP kernel sending the final HTTP response back to the client.

Where people lose the point

• ×Omitting key stages like the HTTP kernel or global middleware.
• ×Confusing the order of operations (e.g., routing before global middleware).
• ×Providing a superficial explanation without detailing the role of different components.

What a strong answer covers

• Explain the purpose of custom middleware: to add specific logic to the request pipeline.
• Describe how to generate a middleware class using `php artisan make:middleware MyCustomMiddleware`.
• Explain the `handle()` method: receiving the request and passing it to the next middleware/controller via `$next($request)`.
• Show how to register the middleware in `App\Http\Kernel.php` (global, group, or route-specific) and apply it to a route.

Where people lose the point

• ×Forgetting to call `$next($request)` in the `handle()` method, which would stop the request.
• ×Incorrectly registering the middleware or applying it to routes.
• ×Providing a use case that could be better handled by other Laravel features (e.g., form requests for validation).

What a strong answer covers

• Explain that both Gates and Policies are used for authorization (what a user can do).
• Describe Gates: simple, closure-based authorization checks, ideal for actions not tied to a specific model (e.g., 'view admin dashboard').
• Describe Policies: classes that group authorization logic around a specific model or resource, ideal for complex, model-specific permissions (e.g., 'update Post', 'delete User').
• Provide a clear example for when to use a Gate and when to use a Policy.

Where people lose the point

• ×Confusing the two or suggesting they are interchangeable.
• ×Failing to explain the organizational benefits of Policies for larger applications.
• ×Providing examples that don't clearly differentiate their best use cases.

What a strong answer covers

• Define mass assignment: passing an array of attributes to an Eloquent model's `create()` or `update()` method, allowing multiple columns to be filled at once.
• Explain the security vulnerability: malicious users could inject unexpected data into columns they shouldn't have access to (e.g., `is_admin`).
• Describe how to protect against it using the `$fillable` property (whitelist of allowed attributes).
• Alternatively, mention the `$guarded` property (blacklist of forbidden attributes), noting `$fillable` is generally preferred for security.

Where people lose the point

• ×Not understanding the security implications of mass assignment.
• ×Confusing `$fillable` and `$guarded` or using them incorrectly.
• ×Failing to explain *why* mass assignment protection is necessary.

What a strong answer covers

• Define unit tests: testing individual, isolated components (e.g., a single method, a helper function) without external dependencies.
• Define feature tests: testing larger parts of the application, simulating user interactions and HTTP requests, often involving multiple components (routes, controllers, models, database).
• Explain when to use unit tests (e.g., complex calculations, specific class logic).
• Explain when to use feature tests (e.g., API endpoints, form submissions, full user flows).

Where people lose the point

• ×Confusing the scope of unit vs. feature tests.
• ×Not mentioning PHPUnit as the underlying testing framework.
• ×Failing to provide clear examples of what each test type would cover.

What a strong answer covers

• Define Service Providers as the central place for all Laravel application bootstrapping.
• Explain their primary function: registering components into the Service Container, binding interfaces to implementations, and configuring various services.
• List examples of what they register: service container bindings, event listeners, middleware, routes, view composers, etc.
• Describe the `register()` and `boot()` methods and their distinct purposes (registering vs. booting/using registered services).

Where people lose the point

• ×Confusing Service Providers with middleware or simple configuration files.
• ×Not understanding the distinction between the `register()` and `boot()` methods.
• ×Failing to explain their role in the overall application bootstrapping process.

What a strong answer covers

• Define queues as a mechanism for deferring time-consuming tasks to be executed in the background.
• Explain how they improve user experience by allowing web requests to respond quickly without waiting for long processes.
• Provide common use cases: sending emails, processing uploaded files, generating reports, image manipulation, third-party API calls.
• Briefly mention the components: jobs, queues, workers, and drivers (database, Redis, SQS).

Where people lose the point

• ×Not understanding the core benefit of asynchronous processing for user experience.
• ×Suggesting queues for tasks that are inherently synchronous or very fast.
• ×Failing to mention the concept of 'jobs' that are pushed to queues.

What a strong answer covers

• Define Facades as providing a 'static' interface to classes available in the Service Container.
• Explain that they offer a convenient, memorable syntax for accessing Laravel's services without manual dependency injection.
• List benefits: expressive syntax, easy to remember, testability (via mocking).
• List drawbacks: can obscure true dependencies, potential for 'static' method abuse, can make refactoring harder if overused.

Where people lose the point

• ×Believing Facades are truly static classes rather than a proxy to the Service Container.
• ×Only listing benefits without acknowledging potential drawbacks.
• ×Failing to explain how they relate to the Service Container.

What a strong answer covers

• Explain that Laravel uses environment variables to manage configuration that changes between environments (development, staging, production).
• Describe the `.env` file: a plain text file storing key-value pairs for environment-specific settings (database credentials, API keys, app URL).
• Explain that `.env` files are typically excluded from version control (`.gitignore`) for security.
• Show how to access these variables in the application using the `env()` helper function or `config()` helper after caching.

Where people lose the point

• ×Suggesting `.env` files should be committed to version control.
• ×Not understanding the security implications of exposing sensitive data.
• ×Confusing `env()` with `config()` and not mentioning config caching.