implement SSE (Server-Sent Events) In Laravel

Ok, and?

this is php script code.

include './config_database.php';

$maxExecutionTime = ini_get('max_execution_time');
$userId = $_GET['user_id'];

header('Content-Type: text/event-stream');
header('Cach-Control: no-cache');
ob_end_flush();

while (true) {
    if (connection_aborted() == -1) break;
    $elapsedTime = time() - $_SERVER['REQUEST_TIME'];
    if ($elapsedTime > ($maxExecutionTime - 10)) {
        break;
    }
    $sql = "SELECT * FROM notifications WHERE is_seen=0 AND user_id=" . $userId . " ORDER BY created_at ASC";
    $result = $conn->query($sql);
    while ($notification = $result->fetch_assoc()) {
        $notfificationId = $notification['id'];
        $query = $dbh->prepare("UPDATE notifications SET is_seen=1 WHERE id= $notfificationId");
        $query->execute();
        $rowCount = $query->rowCount();

        echo "event: message\n";
        echo 'data: ' . json_encode($notification) . "\n\n";
        flush();
        usleep(1000 * 200);
    }
    if ($result->num_rows > 0) {
        echo "event: endData\n";
        echo "data: endData\n\n";
        flush();
    } else {
        sleep(1);
    }

and in javascript i am using EventSource Object to send SSE request All this works well and all users receive real time notifications and no user waits for their request to finish . this is php pure and javascript But actually this is an experiment, and I want to apply this to laravl api, but when I did that, every user started waiting until all the previous requests are finished so that they can receive notifications. whay php pure work fine but in laravel not work fine ? It appears that Laravel handles queued requests and only inserts a new request after the previous one has finished, but in some cases this should be skipped and work in the same way as a pure php file. How can this be done? please help.

$userId = $_GET['user_id'];

$sql = "SELECT * FROM notifications WHERE is_seen=0 AND user_id=" . $userId . " ORDER BY created_at ASC";

https://en.wikipedia.org/wiki/SQL_injection

I'll give you an example. Imagine what happened if someone passed this user_id as a query parameter (URL encoding it first of course):

1; drop table users; --