PHP / Laravel Developer

Somebody built it in 2013
and it still runs the business.
That is not an insult. It is the brief.

PHP engineers who are genuinely good at modern Laravel and genuinely willing to read twelve-year-old code. Full-time in your team, on our payroll, from $22 an hour — the most affordable band on our bench.

Get a shortlistHow hiring works
What a first-week audit usually finds
Unparameterised queries3–40
Composer packages with known CVEs5–20
Business logic inside a Blade fileAlways
Tests0

Across roughly a dozen inherited codebases. We will run the same audit on yours before you commit to anything.

The diff

Twelve lines, four defects, one afternoon

This is what modernisation actually looks like, file by file. Not a rewrite — a strangler pattern applied one controller at a time, with the tests written on the way through.

order_view.phpbefore
<?php
include('db.php');
$id = $_GET['id'];
$q = mysql_query(
  "SELECT * FROM orders WHERE id = $id");
$o = mysql_fetch_assoc($q);
if ($_SESSION['role'] == 'admin') {
  echo "<h1>Order ".$o['ref']."</h1>";
  echo "<p>".$o['notes']."</p>";
}
mail($o['email'], 'Order', $body);
?>
OrderController.phpafter
public function show(Order $order)
{
    $this->authorize('view', $order);

    SendOrderEmail::dispatch($order)
        ->afterCommit();

    return view('orders.show', [
        'order' => $order,
    ]);
}

SQL injection

$id goes straight into the query. Eloquent's route-model binding removes the whole category, not just this instance.

Reflected XSS

$o['notes'] is echoed raw. Blade escapes by default, so you have to opt in to being unsafe.

Authorisation by string comparison

A role check inline in the view. Policies put it in one testable place, and every route gets the same treatment.

Mail in the request

An SMTP timeout becomes a 30-second page load and a lost order. Queued, after commit, with retries.

Day to day

Six things a Laravel hire is worth having for

Version and framework upgrades

PHP 5.6 → 8.3, Laravel 5 → 11, one step at a time with Rector and a test suite built as you go — not a rewrite nobody will fund.

Laravel done conventionally

Form requests, policies, resources, jobs, events. Conventions matter more here than anywhere, because they are why the next developer is productive in a week.

Admin panels that stop being bespoke

Filament or Nova instead of another four months of hand-built CRUD nobody wants to maintain.

Livewire or an API

Server-driven interactivity where it fits, a clean JSON API where you have a React or mobile front end.

Queues and schedules

Horizon, failed-job handling, and a scheduler that runs somewhere with monitoring rather than in a forgotten crontab.

Performance and cost

Query profiling, eager loading, Redis caching and an OPcache configuration that was never actually set.

Seniority

Three bands, 4–7 days to start

The PHP pool is the deepest one we recruit from, which is why lead times here are the shortest on the bench and rates the lowest.

Mid-level

3–5 yrs$22–28/hr

Ships features conventionally in a Laravel codebase. Comfortable with Eloquent, Blade and queues.

Senior

5–8 yrs$28–36/hr

Owns the upgrade path, sets the conventions, and is the person who finds the injection before an auditor does.

Lead

8+ yrs$36–48/hr

Plans the modernisation, splits the monolith where it earns it, and mentors the team into the conventions.

Give us read access for a day

We will come back with the audit above filled in for your codebase, and an honest view of whether it wants one developer or a modernisation project.

Request a shortlistModernisation as a project