Prepared statements are not optional
String-building a query is still how most “quick admin pages” get dumped. Bind the values.
PHP writing
10 posts per page. Authors publish; readers comment after login.
48 posts · 6 authors · 210 comments
What classmap autoload is for
PSR-4 is default. Classmap is for the generated junk you do not want scanned on every request.
Sessions vs a JSON token
If the app is one origin and a cookie already exists, a session is simpler than JWT theatre.