Laravel is the most popular PHP framework. These Laravel interview questions cover routing, controllers, Blade and migrations for freshers, then Eloquent relationships, middleware, the service container, queues, events, authentication, testing and performance for experienced Laravel developers.
30 questions · Updated
Fundamentals, definitions and simple scenarios. Good for freshers and warm-ups.
Laravel is a PHP framework that follows the MVC pattern and provides elegant syntax and many built-in features: routing, Eloquent ORM, Blade templates, migrations, authentication, queues, caching, mail and testing. Its documentation, ecosystem (Forge, Vapor, Horizon, Livewire) and developer experience make it the most popular PHP framework.
Migrations are version control for the database schema: PHP classes that create or change tables, run with php artisan migrate and reversed with rollback.
Seeders insert initial or test data, and factories generate fake model data for testing and seeding.
Together they let every developer and environment build the same database.
Blade is Laravel's templating engine. {{ $value }} prints escaped output to prevent XSS, directives such as @if, @foreach and @auth handle logic, and layouts use @extends, @section and @yield, or components with slots. Templates are compiled to plain PHP and cached for speed.
Artisan is Laravel's command-line tool.
Common commands are php artisan serve, make:model -mcr (model with migration, controller and resource routes), make:controller, make:request, migrate, db:seed, route:list, tinker (an interactive shell), queue:work, schedule:run and optimize.
You can write custom commands for your own tasks.
Routes are defined in routes/web.php and routes/api.php with Route::get, post, put, patch and delete, pointing to closures or controller methods. Route parameters such as {id}, named routes (->name("orders.show")) used with route(), route groups with shared middleware and prefixes, resource routes for CRUD, and route model binding, which loads the model automatically, are the key features.
A resource controller has standard methods for CRUD operations: index, create, store, show, edit, update and destroy.
Route::resource("photos", PhotoController::class) registers all the routes in one line, and Route::apiResource excludes the create and edit form routes for APIs.
This keeps controllers consistent.
Call $request->validate([...]) with rules such as required, email, unique:users,email, min, max, confirmed and exists, or move them into a Form Request class with rules() and authorize().
Invalid input redirects back with errors for web requests, or returns a 422 JSON response for APIs.
Custom rules can be written as classes or closures.
Environment-specific values such as database credentials and API keys live in .env, which is never committed.
Config files in the config folder read them with env(), and the app reads config with config("services.stripe.key").
Calling env() outside config files breaks when config is cached with php artisan config:cache.
Each table has a model class.
Post::create($data) inserts (with $fillable set for mass assignment), Post::find($id) or findOrFail fetches by key, Post::where("status", "published")->latest()->paginate(10) queries, $post->update($data) updates and $post->delete() deletes.
Results are collections with helpful methods such as map, filter and pluck.
Laravel generates a CSRF token for each session and the VerifyCsrfToken middleware checks it on POST, PUT, PATCH and DELETE requests from web routes.
Forms include it with the @csrf Blade directive, and JavaScript requests send it in the X-CSRF-TOKEN header.
API routes using tokens are stateless and do not need CSRF tokens.
Mass assignment means filling a model from an array, such as User::create($request->all()).
If any field were allowed, an attacker could set fields such as is_admin.
Laravel protects against this with $fillable (an allow-list of fields) or $guarded (a block-list).
Using $request->validated() to pass only validated data is the safest practice.
Applied problems, trade-offs and questions about your own projects.
Eloquent defines relationships as methods on models: hasOne and belongsTo for one-to-one, hasMany and belongsTo for one-to-many, belongsToMany for many-to-many with a pivot table, hasManyThrough for distant relations, and polymorphic relationships such as morphMany for comments on several models. They are queried as properties, such as $post->comments.
By default relationships load lazily, so looping over 50 posts and reading $post->author runs 51 queries, the N+1 problem.
Eager loading with Post::with('author')->get() loads all authors in one extra query.
Laravel can throw an exception on lazy loading in development with Model::preventLazyLoading() to catch these problems early.
Middleware filters HTTP requests entering the app, such as auth to check the user is logged in, throttle for rate limiting, and verified for email verification.
Custom middleware is created with artisan and can run before or after the request.
It is attached to routes or groups, or registered globally in bootstrap/app.php in Laravel 11 and later.
Queues move slow tasks, such as sending emails, processing images or calling external APIs, into background jobs so the user gets a fast response.
A job class is dispatched with dispatch(), stored in a queue driver such as Redis, database or SQS, and processed by php artisan queue:work.
Horizon monitors Redis queues, and failed jobs can be retried.
Casts convert attributes automatically when reading and writing, such as "is_active" => "boolean", "settings" => "array" or "price" => MoneyCast::class, and "datetime" for Carbon dates. Accessors and mutators, defined with Attribute::make(get: ..., set: ...), transform values, for example formatting a full name or hashing a password when it is set.
Local scopes are reusable query constraints defined on the model, such as scopePublished, used as Post::published()->get().
Global scopes apply automatically to every query on a model, such as filtering by the current tenant, and SoftDeletes uses a global scope to hide deleted rows.
Scopes keep query logic in one place.
An event class represents something that happened, such as OrderPlaced, and listeners respond to it, such as sending a confirmation email or updating stock.
Events are dispatched with OrderPlaced::dispatch($order), and listeners can implement ShouldQueue to run in the background.
Model observers react to Eloquent events such as created and updated.
Mailables are classes that build emails with Blade or Markdown templates and are sent with Mail::to($user)->send(new OrderShipped($order)), usually queued.
Notifications send the same message over several channels, such as mail, database, SMS through Vonage, Slack or broadcast, from one class with a via() method.
Both can be previewed and faked in tests.
Starter kits (React, Vue or Livewire) provide login, registration, password reset and email verification out of the box; Breeze and Jetstream are the older kits.
Fortify is a backend-only authentication implementation.
Sanctum handles API tokens and SPA cookie authentication, Passport provides a full OAuth2 server, and Socialite adds login with Google, GitHub and others.
Facades provide a static-looking interface, such as Cache::get() or DB::table(), to services in the container.
Behind the scenes, Laravel resolves the real object from the container and calls the method on it, so facades are still testable with Cache::shouldReceive() or fakes such as Mail::fake().
Dependency injection is an equally valid alternative.
The Storage facade gives one API for the local disk, S3 and other cloud storage, configured in config/filesystems.php. $request->file("avatar")->store("avatars", "s3") saves an upload with a unique name, Storage::url() builds public URLs, temporaryUrl() creates expiring links for private files, and php artisan storage:link exposes the public disk.
System design, deep internals, leadership and tough follow-ups.
The service container manages class dependencies and performs dependency injection, resolving classes automatically through type hints in constructors and methods.
You can bind interfaces to implementations, or register singletons.
Service providers are where bindings, event listeners, routes and other bootstrapping are registered; their register method binds and their boot method runs after all providers are registered.
I define routes in routes/api.php, use API resources to shape JSON responses, validate input with Form Request classes, and authorise actions with policies and gates.
Authentication uses Sanctum for SPA and mobile tokens, or Passport for full OAuth2.
I apply rate limiting, use mass-assignment protection with $fillable, and version the API.
Run php artisan optimize to cache config, routes, events and views, use composer install --optimize-autoloader --no-dev, enable OPcache, and use Redis for cache, sessions and queues. Eager load relationships, add database indexes, cache heavy queries, paginate, move slow work to queues, and consider Laravel Octane to keep the app in memory between requests.
Every request enters public/index.php, which loads Composer's autoloader and creates the application from bootstrap/app.php.
The HTTP kernel runs global middleware, service providers register and boot services, the router matches the route, runs route middleware and calls the controller, and the response travels back through the middleware to the browser.
Terminable middleware can run after the response is sent.
Laravel supports PHPUnit and Pest.
Feature tests send HTTP requests with $this->get() and $this->postJson() and make assertions on status, JSON and the database, using RefreshDatabase and model factories for data.
Fakes for Mail, Queue, Event, Notification, Storage and Http let you test side effects without sending anything.
Browser tests use Dusk.
Octane keeps the application in memory between requests using FrankenPHP, Swoole or RoadRunner, removing the start-up cost of every request and greatly increasing throughput, but code must avoid leaking state between requests. Horizon is a dashboard and configuration system for Redis queues, showing throughput, failed jobs and worker balancing.
Livewire builds dynamic interfaces with PHP classes and Blade templates; the frontend communicates with the server through AJAX automatically, so you can build reactive pages without writing much JavaScript. Inertia connects Laravel to React, Vue or Svelte pages without building a separate API: controllers return Inertia responses and the frontend renders them as a single-page app.
Deploy with tools such as Laravel Cloud, Forge, Vapor (serverless on AWS) or Envoyer for zero-downtime releases, or with containers.
Run php artisan optimize, migrations and queue restarts on each release.
Scale with several app servers behind a load balancer, shared Redis for cache, sessions and queues, separate queue workers supervised by Horizon, the scheduler running on one server, and files on S3.
See all Backend Developer interview questions, covering Node.js, Express.js, NestJS, Python, Django and more.