GUIDES
url()->current(), request()->fullUrl(), and route()->currentRouteName() — the difference between the URL, the route name, and the query string, and when each one is the right check.
Every path helper resolves relative to the actual project's real location on disk — hardcoding an absolute path instead breaks the moment the app is deployed to a different server or directory structure.
url()->current() and url()->full() differ by exactly one thing — whether the query string is included — a distinction that matters the moment a "highlight the active filter" or "preserve search params" feature needs it.
A simple session-stored, image-rendered CAPTCHA — generated with PHP's GD library, validated against the session, and refreshable without a full page reload.
A facade is a static-looking proxy to an object resolved from the service container — three pieces (the underlying class, the facade class, and a binding) that all have to line up.
composer remove handles the package itself — the parts worth double-checking afterward are any leftover config file, service provider registration, or published assets it left behind.
Resizing an image's dimensions and reducing its file size via compression quality are two separate levers — Intervention Image handles both.
A file stored on the public disk isn't automatically web-accessible until the storage:link symlink exists — the single most common cause of a broken image path after upload.
diffForHumans() is what turns a raw timestamp into '3 hours ago' — a small but genuinely important detail for how approachable a UI's dates feel compared to a raw ISO string.
Blade's {{ }} escapes output by default as an XSS protection — {!! !!} skips that escaping, which means it should only ever be used on content you genuinely trust.
A minimal OTP login flow built on top of Laravel's own auth system — generate a code, email or text it, verify it, then log the user in — without reaching for a full package if you don't need one.
A CORS misconfiguration only ever breaks browser-based cross-origin requests — a tool like Postman or a server-to-server call is entirely unaffected, since CORS is a browser-enforced restriction, not a server-side one.
