A Fluent Path Builder for PHP and Laravel

Published on August 29th, 2025 by Paul Redmond

LaraPath is a secure, fluent path builder for PHP, featuring sanitization strategies and Laravel integration for version 11+. This package's use cases range from multi-tenant storage organization with privacy protection, file naming conflict resolution, and data loss prevention, among others.

// Hash sensitive data
$path = PathBuilder::base('storage')
    ->add('user@email.com', SanitizationStrategy::HASHED)
    ->toString(); // "storage/5d41402abc4b2a76b9719d911017c592"
 
// Create URL-friendly names
$path = PathBuilder::base('uploads')
    ->add('My Amazing File!', SanitizationStrategy::SLUG)
    ->toString(); // "uploads/my-amazing-file"
 
// Convert to snake_case
$path = PathBuilder::base('files')
    ->add('CamelCase Name', SanitizationStrategy::SNAKE)
    ->toString(); // "files/camel_case_name"
 
// Add timestamps for uniqueness
$path = PathBuilder::base('temp')
    ->add('session', SanitizationStrategy::TIMESTAMP)
    ->toString(); // "temp/session_1640995200"

This package also includes a Laravel integatration, which a Facade

// Facade example
$exists = LaraPath::base('uploads')
    ->add('avatar.jpg')
    ->exists('public'); // Uses Storage::disk('public')->exists()
 
// Container binding
app('larapath')
    ->base('files')
    ->add('document.pdf')
    ->size(); // Uses Storage::size()

It also includes validation and security, which automatically validates dangerous paths, as well as the possibility of manually checking a path:

// Automatic validation
$path = PathBuilder::base('uploads')
    ->add('../../../etc/passwd') // Dangerous path
    ->validate() // Throws InvalidArgumentException
    ->toString();
 
// Manual safety check
$isSafe = PathBuilder::isSafe('uploads/../dangerous/path'); // false

Main Features

Security First: Built-in protection against directory traversal attacks
Fluent API: Clean, readable path building with method chaining
Sanitization Strategies: Multiple strategies for different use cases (hash, slug, snake_case, timestamp)
Immutable Operations: Thread-safe path building with no side effects
Strategy Pattern: Extensible sanitization system
Type Safety: Full type hints and IDE autocompletion
Laravel Integration: Optional Laravel Storage facade integration