# System + Apps Coding Standards

## PHP

- Target PHP 8.x.
- Follow PSR-12 style where practical.
- Use clear names; keep controllers thin; push logic into services.
- Validate and sanitize all external input.
- Use PDO with prepared statements for dynamic queries.
- Log errors with useful context but avoid leaking sensitive data.

## Shell (sh / bash)

- Use #!/usr/bin/env bash for non-trivial scripts.
- Default to set -euo pipefail for safety.
- Always quote variable expansions.
- Provide dry-run or confirmation for destructive operations.
- Group logic into functions; avoid long, unstructured scripts.

## JavaScript (browser)

- Use clear names; avoid magic values.
- Handle async flows explicitly.
- Avoid unsafe DOM operations.
- Keep state predictable; minimize hidden globals.
- Respect basic accessibility.

## HTML / Bootstrap

- Use semantic HTML where possible.
- Use Bootstrap components consistently.
- Keep custom CSS scoped.
- Ensure responsive behavior.

## SQL / MySQL / PDO

- Use explicit joins; avoid SELECT * in hot paths.
- Index columns used in WHERE, JOIN, ORDER BY.
- Use prepared statements and bound parameters.
- Be mindful of transactions and locking.

## General

- Priorities: correctness, security, performance, readability, reuse, standards.
- Changes should have clear commit messages and appropriate tests.