Laravel Spark 1.0 is now available
spark.laravel.com
spark.laravel.com
Pre 2015, I rolled my own PHP framework. I eventually decided I should take the time to learn a modern framework and narrowed my choices down to Django & Laravel. Ended up going with Django; just curious to see what I missed out on.
Both Laravel and Symfony are the leading PHP frameworks and they're both very popular.
https://github.com/laravel (framework org)
https://github.com/illuminate (Laravel components org)
https://github.com/symfony (framework+components org)
Notably, there is also a difference between the laravel/laravel and laravel/framework -- one has the core code and the other is the public face of the project. Looking at only the former will skew their appearance.
Furthermore, Laravel heavily uses/wraps core Symfony packages (eg: console, http-kernel, routing, process, translation, etc).
Competition between the two is definitely occurring, which is a good thing as they are both comprehensive and modern PHP frameworks.
Disclaimer: this is just my feeling based on people I've talked to and talks I've seen, and not backed by any hard data.
Of course this is subjective, as everyone draws the line of "how much do I want my libraries/framework to do for me vs. how much do I want to do myself" in a different place.
It pretty much ships with everything you need to build an app: scaffolding, migrations, authentication, middleware, templating, caching. Most of getting up and running is really configuring a bunch of settings that takes virtually no time at all.
I'm a huge Laravel fan. They also have a slimmed down version called Lumen, which is pretty much specifically for APIs. Lumen stays up-to-date with Laravel, so you get the benefits of both worlds there.
A few weeks back I needed to port some crypto from Laravel to Go. I did not have too much trouble – apart the strange usage of Rijndael-256 that Laravel had until one version or two ago. When I looked at the way they were using keys to encrypt data, I realized that they were directly using "application private key". Is that bad? It shouldn't, but Laravel makes sure all the keys it generates are ASCII, for copy/pasting convenience. What happens if you're using a 256-bit key that can be represented with ASCII? The key space is 10^20 times smaller (the entropy of a byte in the key goes from 256 to 62!). That's been a thing in the most "modern framework" in PHP for more than three years. I'm far from being a security professional, but spending one hour on one file was enough to find a basic security issue. Let's just say we're not writing code with Laravel anymore.
I must mention that Taylor Otwell (the author) was extremely fast for fixing the problem. He is probably among the best open source project maintainers I know, and desserves to live off this work on Laravel.
Here is the commit: https://github.com/laravel/framework/commit/370ae34d41362c3a...
Frankly, writing web apps in Laravel is damn near a joy compared to the rest. We still do most of our big stuff with Java or Python and async/scripty stuff in Node, but a fair number of web apps that would've been Spring Framework by default a few years back have been very quickly whipped up in Laravel.
We've launched pretty heavy traffic sites in the last few years that have utilized Elastic Beanstalk, SQS, Elastic Search, and a whole host of other goodies that integrate very easily with Laravel.
Spark and Laravel are a super good combo to start an app with, I personally think php's ease of deployment (plus how cheap Laravel Forge is) blows rails out of the water.
I personally find it much less headache-inducing than NPM, but I think practically, they're about the same in terms of what they do.
PHP:
(1) Install PHP (2) Install Composer (3) Run 'composer install' to download dependencies
Node:
(1) Install Node.js (2) Install npm (3) Run 'npm install' to download dependencies