1.0.0

A read-only database browser you drop into a Laravel application. Install it, open /db, and get your tables on the left and their rows on the right.

Works with MySQL / MariaDB, PostgreSQL and SQLite.

composer require --dev monicahq/laradb

What you get

• Every table in the schema in the sidebar, with row counts — exact on SQLite, engine estimates on MySQL and PostgreSQL so listing a large schema stays cheap.
• The grid, dense and monospace: column types, PK and FK badges, absolute row numbers in a gutter that stays put when you scroll sideways, and NULL rendered as something you can tell apart from an empty string.
• Follow a foreign key through to the row it points at. The value is a link; clicking it lands you on the target table narrowed to that row, with a chip naming the key you came through.
• The chrome tells you where you are: engine and version, the database being browsed, its size and index count, the settings the engine reports about itself — and, for the page in front of you, the statement that produced it and how long it took.
• No CDN. The page ships its own CSS and JavaScript. No build step, no Tailwind, no Alpine. The only remote request is a webfont, and the layout is intact without it.
• A JSON endpoint on /db/tables/{table}?format=json for when you want the rows rather than the page.

Read-only by construction

The interesting part of a database browser is what it refuses to do.

• Both routes are GET; the package issues nothing but SELECT.
• Table names are matched against schema introspection before anything is built — a name outside that whitelist is a 404, never a query.
• Identifiers are quoted per engine, inner quotes doubled, so a table named we"ird cannot break out of one.
• LIMIT and OFFSET are integers from arithmetic, never interpolated strings.
• The one value that comes from the URL — the foreign-key filter — is always bound, and its column must be one a foreign key actually targets.
• There is no query box. The package cannot run arbitrary SQL because it has nowhere to accept it.
• Connection errors are sanitised: PDO quotes the DSN and the database user, so the page shows a neutral message and the real error goes to your log.
• SQLite's absolute file path is shortened to the project root, or the bare filename when it lives outside.

Before you install it

It renders the contents of your database in a web page. Install it with composer require --dev, keep it out of production builds, and put an authorisation gate in front of it — the default ['web', 'auth'] middleware only proves the visitor is someone. See Who can reach it.

Requirements

PHP 8.1+ · Laravel 10, 11 or 12 · ext-pdo

Tested on CI against PHP 8.1–8.4 × Laravel 10/11/12, with real MySQL and PostgreSQL servers.