Learn PHP with Claude in 2026: build real skills, not AI dependency

Code review last week. A "fullstack" dev shows me his Laravel API. Clean on the surface — well-organized controllers, Eloquent migrations, Form Request validation. I ask him why he's using $request->all() instead of $request->validated() in his controller. Blank stare. He didn't know that all() returns everything in the payload, including unvalidated fields. Claude generated the controller, he copied it, it worked. Six months of Laravel and a dormant mass assignment vulnerability in every…