Leonardo Zillo - Senior Software Architect PHP and MySQL

The pillars of your solution

Architecture built to last

Design of web systems with robust design patterns (MVC, SOLID) in plain PHP, with no framework dependency. The result is lean, clean and secure code that runs on any hosting and lasts without rewrites forced by third-party updates.

Custom management software

Sales, barcode-based inventory, repairs, rentals, PDF contracts, customer portal, NFC and QR cards, signed integrations between different systems. Built around the way you actually work, and updated to new regulations when they change.

Legacy modernization

Taking over applications that have grown over the years, even when written by many hands and without documentation. Their real structure is mapped and they are evolved in small, reversible steps, while remaining in production.

Database optimization

Beyond development: advanced MySQL/MariaDB optimization, from schema design to query tuning.

Security and hardening

Line-by-line code audit, issues ranked by severity and fixed one at a time with verification in production: logins, sessions, password recovery, SQL injection, uploads, credentials and protection of server folders.

Hosting and maintenance

More than development: coverage of the full life cycle. Hosting, ongoing maintenance and automatic database backups. Controlled releases, with a dated backup of every file, sha256 verification and a log of every deploy. MySQL and PHP configuration.

Real examples

Projects

The projects in production are used every day by real people and concern scuba diving, where a wrong figure is not just a software error. Last comes a historical project from a different industry.

UTRtek Ltd (London)

Management system modernization

London-based company specialized in technical diving. The internal software and customer portal (instructors, courses, certifications, NFC cards, medical certificates, statistics, mailing) were built on a legacy framework (phpMyEdit) that prevented PHP upgrades, with MySQL query bottlenecks and vulnerabilities caused by outdated libraries.

153

tables mapped, verified against real access logs

L. 70/2026

digital dive log aligned with Italian law

9 languages

over 12,000 phrases translated

What was done

Complete redesign of the application: new architecture in OOP PHP and MySQLi on solid patterns (MVC, SOLID), caching, extended validation and structural optimization, fully compatible with modern PHP.
Ongoing maintenance with controlled releases: dated backup of every file and a deploy log.
Complete project map (153 tables, hundreds of files) and of the dependencies between modules, checked against real access logs before any cleanup.
Security audit module by module, with targeted fixes deployed and verified in production.
Modern authentication: the instructor and NFC card areas moved to server-side sessions, file by file, with no interruption for users.
Digital dive log with the instructor's graphic signature and PDF/CSV export, aligned with Italian Law 70/2026 (art. 12, paragraph 8).
Multilingual card area with a language selector, on a base of over 12,000 phrases in 9 languages.
Course automation: daily reminders to instructors about courses nearing their deadline and nightly cancellation of expired courses, switched on after dry runs and with a log of every operation.
IP blocking reworked after an injection attempt through HTTP headers: addresses are validated before they reach the server rules.
Service continuity: when the hosting provider started rejecting multipart submissions, file uploads (medical certificates included) were restored with no change for users and files arriving identical to the original.

Blue Deep BDX

Custom management system

Complete management system for a scuba equipment shop with a dive school, designed and written from scratch starting in May 2026 and used every day by the staff. Shop requests become releases within a few days, often the same day, and every version is documented.

231

releases in under 6 months

92

tables designed

every hour

automatic database backup

What it includes

Sales and inventory with EAN/UPC barcode reader, import from CSV price lists, price history, returns, margins, quotes with automatic expiry.
Repairs and inspections with spare parts drawn from stock, attachments and legal deadlines by equipment category.
Custom-fit wetsuits, rentals with individual units and deadlines, gas blending station, container access codes.
Self-access container: padlock code released after a mandatory declaration, dive register with buddies, automatic suspension after dives without registered buddies, and corrections tracked with reason and history.
Courses and contracts: instructor agreements generated as PDF, reprinting, revocations, signed attachments.
Customer portal with deadlines, documents, receipts, loyalty cards and a digital dive logbook aligned with Italian Law 70/2026 (UDDF import and export, QR code for the SSI app, PDF/CSV export).
Newsletter with sending queue and opt-out, usage statistics, dashboard notifications, login with attempt limits per user and per IP.

Touzil System

Own product · since 2008

Free software that calculates Oxygen Drop and the growth of helium and nitrogen in passive semi-closed rebreathers (pSCR). Oxygen Drop is one of the main risk factors of this type of apparatus: Touzil was created to understand it better and make pSCR diving safer. Online since 2008, still developed and updated today.

18 years

online and continuously evolving

v2.5

latest version, May 2026

free

registration only

Try Touzil System

What it calculates

Oxygen drop in the circuit at different depths, from body weight, surface consumption, dive effort (relaxed or strenuous) and counterlung ratio.
Helium and nitrogen growth in the breathing mixture and maximum operating depth.
CO₂ absorbent duration based on type and loaded quantity.
Gas management in overhead environments: rule of thirds and usable bar/liters in pSCR, leaving twice the gas needed to exit on open circuit.
Altitude diving, non-editable safety parameters, convenient smartphone use.

Gas Blending Station

Own product · Technical calculation

Professional calculator for preparing breathing mixtures by partial pressures: Nitrox, Heliair, Trimix and Heliox. Born as a Nitrox prototype, it is now a professional tool in production, used every day for cylinder filling.

4

mixture families

PDF

printable filling sequence

IT / EN

available in Italian and English

What it includes

Final mixture calculation by partial pressures, starting from the gas left in the cylinder.
Mixture correction and complete refill, with calculation of the optimal top-up.
Step-by-step blending sequence for the operator, exportable to PDF.
Gas cost optimization, with configurable gas prices.
Database of standard mixtures, oxygen and helium safety warnings, analysis log required by regulations.

Cementizillo SpA, Calcestruzzi Zillo SpA, Casali Sartori SpA

Historical project · Family companies

Replacement of the IBM System/36 management system with a PHP and MySQL application for a group of three companies, proposed as an alternative to the AS/400 migration, which had been only partly started. Responsibility for the whole project included the architecture, the database schema and the planning of how and when the switch would happen. The project started around 2001 with invoicing and shipment management alone and, in phases, came to cover the entire company.

3

companies integrated into a single system

S/36 → PHP + MySQL

complete migration

phased

from invoicing to the whole company

What was done

Architecture and database schema designed by the project lead; the code was written by a team of developers.
Migration plan: how and when the switch would happen, defined in advance and followed through every phase.
Gradual start from invoicing and shipment management alone, then phased extension to the rest of the company.
Process integration: from the weighbridge to inventory, from office documentation to administration, from the vehicle fleet to personnel management.
Integration of the three companies (Cementizillo, Calcestruzzi Zillo, Casali Sartori) into a single system.

How the work is done

On production systems the risk is not writing new code: it is breaking what already works. The method exists to prevent that.

Measure first, then act

Every hypothesis about the code is checked against real production data before anything is moved, deleted or fixed.

Small, separate changes

Every change is shown individually in a before/after format. No bundles of merged changes that are hard to review.

Rollback always ready

Dated backup of every file before replacing it, sha256 checksum verification after upload, a log of every deploy with the command to roll back.

Living documentation

Version history, database schema, audit status and decisions taken stay written down and up to date: the project does not depend on anyone's memory.

On the system you have

Shared hosting, outdated PHP versions, no test environment: the work adapts to real constraints instead of imposing a migration before starting.

The database stays yours

Changes to the production database are prepared as reviewed SQL scripts and executed under your control.

Technical stack

Languages: plain PHP (OOP and procedural, from legacy versions < 5.5 to current ones, including migrations away from outdated frameworks), advanced SQL, JavaScript.

Databases: MySQL / MariaDB (schema design, optimization, stored procedures, scheduled events).

Documents and data: PDF (FPDF/FPDI), CSV, UDDF/XML, EAN barcodes, QR codes, NFC, transactional email and newsletters.

Infrastructure: Linux (Debian), automatic backups, controlled releases with sha256 verification and rollback.

Security: code audit, server-side sessions, HMAC signing, login attempt limiting, XXE and upload protection.

Methodology: design patterns (MVC), SOLID principles, verification on real data before every change, documented version history.

Ready to make your software more stable and more secure?

Whether the task is designing a new architecture, bringing back into shape a management system that nobody wants to touch any more, or solving critical performance and security problems, the consultancy is direct and every change can be verified in production.

Work is carried out on complete projects, from design to release, or as ongoing maintenance on systems already in production. After the first call, if needed, a technical analysis of the existing system is agreed.

Before starting: free 30-minute introductory call

Email: info@zillo.it

Phone: +39 349.844.1418

WhatsApp: Start a chat

Send an inquiry

Available as a freelance consultant.

Web software that works today and lasts for years.