What PHP is
Expand the namePHP: Hypertext Preprocessor, a recursive acronym.
TipIt is an open source, server-side scripting language. The same code runs on Linux, Windows and macOS.
Asked in interviews
AskedWhat is PHP and what does it stand for?
Done 0/0
To review 0
Old way, still asked about
The usual way today
Newer, PHP 8.0 or later
The model
- PHP runs on the server and sends only its output, usually HTML. Each request starts fresh and frees everything at the end. In this shared-nothing model, state survives only in outside storage.
- A variable takes its type from its value, and PHP converts types as needed. This is type juggling. Use
===and strict types to stop it. - Every array is one type, an ordered map from keys to values. Lists and dictionaries are both this map.
- An object variable holds an identifier, not the object. Passing it copies the identifier, so a function changes the same object.
Syntax & types
how a script looks and how PHP treats valuesTags and output
Print a value in HTML
<?= $name ?>Print several values
echo "a", "b";Print, then return 1
print "a"TipLeave ?> out of a PHP-only file, so no stray newline gets sent.
TrapShort tags <? ?> need short_open_tag, so avoid them. PHP 7.0 removed ASP tags <% %>.
Strings and constants
Keep text literal
'Hi $name'Expand an array value
"Hi {$u['name']}"Write multi-line text
<<<EOT<<<'EOT'Declare a constant
const MAX = 10;define('MAX', 10);TipHeredoc expands and nowdoc doesn't. const is compile time, so only define() works inside an if.
TrapIn single quotes, only \' and \\ are special. So '\n' is a backslash and the letter n.
Types and comparison
Compare value and type
$a === $bCompare loosely
$a == $bSee type juggling
"10" + 5; // 15TipScalar bool, int, float, string. Compound array, object, callable. Special null, resource.
TrapSince PHP 8, 0 == "foo" is false, and "abc" + 5 throws a TypeError. "1" == "01" is still true.
Null coalescing and spaceship
Use a default if missing
$a['k'] ?? 'x'Assign if missing (7.4+)
$a['k'] ??= 30Get -1, 0 or 1
$a <=> $bTip?? treats null as missing and raises no warning. <=> is what usort() callbacks return.
Loops and match
Exit or skip in a loop
break;continue;Map a value to a result
match($v) { 1 => 'a' };Tipmatch returns a value, uses === and never falls through. No matching arm throws Unhandled.
TrapIn a switch, a bare continue acts like break. Use continue 2 to reach the loop.
Type declarations
Stop scalar conversion
declare(strict_types=1); Type a property (7.4+)
public int $id;Allow several types
int|float?stringTipA typed property with no default starts uninitialized, not null. Reading it first throws an Error.
TrapStrict mode for arguments follows the calling file, not the file that defines the function.
Functions & arrays
calling code and working with PHP's one array typeCalls and arguments
Call by variable name
$func();Accept extra arguments
function f(int ...$n)Read them the old way
func_get_args()Pass by value or reference
function f($x)function f(&$x)TipObjects don't pass by reference. PHP copies the identifier, so only & lets a new object reach the caller.
TrapCheck a name from user input against an allowlist, or a user could run any function.
Closures and scope
Capture by value or by reference
function () use ($p)function () use (&$p)Capture with
fn (7.4+)fn($x) => $x * $fReach a global
global $count;Keep a value across calls
static $n = 0;TrapUnlike C, a function can't see globals by default. Only superglobals are visible everywhere.
Array keys
Check a key exists
array_key_exists($k, $a)Check for non-null
isset($a[$k])Treat empty as missing
empty($a[$k])TipAn array is one type, an ordered map. It can mix integer and string keys, and it keeps insertion order.
TrapPHP converts keys. "8" becomes 8 and true becomes 1, but "08" stays a string.
Merge and transform arrays
Join arrays
array_merge($a, $b)Pair keys with values
array_combine($k, $v)A size mismatch throws a ValueError since 8.0.Transform, keep or fold
array_map($fn, $a)array_filter($a, $fn)array_reduce($a, $fn, 0)Tiparray_merge renumbers numeric keys, and a later string key wins. $a + $b keeps the first array's values.
Traparray_filter() keeps the original keys. Wrap it in array_values() for a clean list.
Classes & objects
OOP in PHP and the newer class featuresOOP, chaining and static binding
Name the four principlesEncapsulation, inheritance, polymorphism, abstraction.
Chain method calls
return $this;Use the defining class
self::who()Use the called class
static::who()new static()TipB::test() runs A's method. There self::who() means A and static::who() means B, so it prints AB.
Trapparent:: and self:: forward the called class. A direct A::foo() resets it.
Interface, abstract class or trait
Share a capability
class A implements B, CShare code and state
abstract class RepoCopy methods into a class
use Timestampable;TipA class extends one parent but implements many interfaces. Traits share code beyond that parent.
TrapTwo traits with the same method are a fatal error until you pick one with insteadof.
Magic methods
Catch missing members
__get()__set()__call()Act as a string or function
__toString()__invoke()Control serialization
__serialize()TrapEvery magic method except __construct(), __destruct() and __clone() must be public, or PHP warns.
Asked in interviews
AskedWhat are magic methods in PHP?Promotion, readonly and enums
Promote a constructor argument
__construct(private $x)Allow one write (8.1+)
readonly int $id;Change a copy (8.5+)
clone($o, ['a' => 1])Declare an enum (8.1+)
enum Status: stringRead a case from a value
Status::from('a')Status::tryFrom('a') Tipfrom throws a ValueError on an unknown value, and tryFrom returns null. Each case is a single object.
Trapclone is shallow, so the copy shares objects in properties. Hold Date, not DateTime.
Attributes and reflection
Add metadata
#[Route('/users')] Check a parent (8.3+)
#[\Override]Inspect a class
new ReflectionClass($c) TipA custom attribute does nothing until code reads it with getAttributes(). DI containers and ORMs do this.
Trapset has had no effect since 8.1 and is deprecated as of 8.5.
Errors, debugging & tests
report problems, find them and prove the fixErrors and exceptions
Stop the script
E_ERRORE_PARSEReport and keep going
E_WARNINGE_NOTICEHandle warnings yourself
set_error_handler($f); Catch any throwable
catch (Throwable $e)TipError, such as TypeError, and Exception both implement Throwable. Custom classes extend Exception.
Traptry and catch can't catch warnings or notices. They go to the error handler.
Custom exceptions and finally
Create your own type
extends ExceptionKeep the cause
new E($m, 0, $prev)Catch two types (7.1+)
catch (A | B $e)Run cleanup either way
finally { ... }TipgetPrevious() reads the cause back. PHP tries catch blocks in order, so put specific types first.
Trapexit() or a fatal error skips finally. A return in finally replaces the earlier return value.
Debug an app
Step through codeUse Xdebug in an IDE, with breakpoints.
Log an array
error_log(print_r($d, true));TipRead the error log first. In production, keep display_errors off.
Asked in interviews
AskedHow do you debug PHP applications effectively?Tests and coverage
Name the test typesUnit, integration, functional and acceptance, from fast to slow.
Assert in a
TestCase$this->assertEquals(4, $n);TipPCOV reports line coverage. Xdebug also reports branches. Aim for 70-80%.
TrapCoverage shows which code never ran, not what is tested well.
Mocks and stubs
Return a fixed answer
$this->createStub(Repo::class) Verify a call happened
$this->createMock(Mail::class) TrapToo many mocks tie tests to implementation details, so a refactor breaks them.
Asked in interviews
AskedExplain mocking and stubbing in PHP testing.Databases with PDO
safe queries, transactions and query countsPDO and prepared statements
Use a placeholder
$pdo->prepare('... id = ?')Bind values and run
$s->execute([$id]);TipChoose PDO for portability across 11 drivers, and MySQLi for MySQL-only features. Their speed is about the same.
TrapPlaceholders stand only for values. Check table names and ASC against an allowlist.
Transactions and query tuning
Start it before
try$pdo->beginTransaction() Save or undo it all
$pdo->commit();$pdo->rollBack(); Read the query plan
EXPLAIN SELECT ...Page past a deep
OFFSETWHERE id > ? LIMIT 20TipIndex the WHERE, JOIN and ORDER BY columns. PHP has no built-in connection pool, so use PgBouncer or ProxySQL.
TrapMyISAM has no transactions. In MySQL, DDL such as CREATE TABLE commits the open one.
N+1 and eager loading
Load rows in one query
WHERE id IN (...)Eager load in Laravel
Book::with('author')->get()TipLazy loading suits optional data, and Eloquent is lazy unless you ask. PHP 8.4 added native lazy objects.
TrapOne query per list item is N+1. 25 books and their authors cost 26 queries, not 2.
Sessions & security
the attacks interviewers ask about, and the PHP fixSessions and cookies
Store on the server
$_SESSION['id'] = 7;Store in the browser
setcookie('a', 'b');Protect the cookie
session.cookie_httponly session.cookie_secure Reject planted IDs
session.use_strict_mode Get a new ID at login
session_regenerate_id(true); Expire a session yourselfStore last activity.
gc_maxlifetime isn't a timeout.TipA cookie holds about 4KB, and the user can change it. Use a session for what the user must not change.
TrapIn session fixation, the victim logs in on an ID the attacker planted. A new ID at login defeats it.
SQL injection and XSS
Stop SQL injectionUse a prepared statement, so input stays data.
Encode HTML output
htmlspecialchars($s)TipLeast privilege limits an injection's damage. Content-Security-Policy limits script sources.
TrapHTML encoding doesn't protect data inside JavaScript or a URL. Encode for that context.
CSRF
Make a token
random_bytes(32) Compare in constant time
hash_equals($a, $b)TipAdd SameSite=Lax as a layer, not a replacement.
TrapCross-site scripting (XSS) defeats every CSRF defense, so prevent it too.
Asked in interviews
AskedWhat is CSRF and how do you protect against it?Password hashing
Hash a password
password_hash($p, PASSWORD_DEFAULT) Check a password
password_verify($p, $h)Spot an old hash at login
password_needs_rehash() TipMake the column 255 wide. PASSWORD_ is bcrypt today, and 8.4 raised its cost from 10 to 12.
TrapNever use MD5 or SHA-256. They are fast, so attackers test guesses at high speed.
Asked in interviews
AskedHow do you properly hash passwords in PHP?File uploads
Move an upload
move_uploaded_file() Block script executionStore it outside the web root, under a random name.
TrapThe browser supplies the name and MIME type in $_FILES. Check the real content.
Asked in interviews
AskedWhat are the security implications of file uploads?Requests & APIs
read input and build web servicesSuperglobals, GET and POST
Read query or form
$_GET['q']$_POST['q']Read the other inputs
$_FILES$_COOKIE$_SERVERRead a JSON body
php://inputTipGET reads, with data in the URL, and is safe and idempotent. POST changes data, in the body.
TrapNeither encrypts. Send passwords with POST over HTTPS, because URLs end up in logs.
REST, SOAP and API auth
Build most APIsREST, with HTTP methods.
Meet a strict contractSOAP, with XML envelopes.
Authenticate a serverAn API key, stored hashed.
Let an app act for youOAuth 2.0.
Skip a database lookupA signed JWT.
TrapFix the JWT algorithm, and check expiry, issuer and audience. A JWT stays valid until it expires.
CORS
Allow one origin
Access-Control-Allow-OriginEnd an
OPTIONS preflightexit();TipThe browser enforces CORS. It isn't authentication.
Trap* can't be used with cookies. Echo one origin from an allowlist, and send Vary: Origin.
Asked in interviews
AskedWhat is CORS and how do you handle it in PHP?Rate limiting
Count in Redis
$redis->incr($key);TipReject with status 429. A sliding window stops a client sending twice the limit across a window boundary.
TrapIf the process dies between incr() and expire(), the key never expires. A Lua script does both at once.
Asked in interviews
AskedHow do you implement rate limiting in PHP APIs?Composer & tooling
load code, manage packages and set up a projectInclude, autoload and namespaces
Load, warn if missing
include 'a.php';Load, stop if missing
require 'a.php';Skip a file already loaded
require_once 'a.php';Load a class on first use
spl_autoload_register() Declare and import names
namespace App\Models;use App\Models\User;TipWrite \Exception for a global class. Functions and constants fall back to global, so strlen() works.
TrapA use statement only imports a name. The file loads on first use, such as new User().
Composer, PSR and code style
Add a package
composer require a/bInstall from the lock file
composer installFetch newest versions
composer updateName the common PSRsPSR-4 autoload, PSR-3 logger, PSR-7 HTTP. PER Coding Style replaces PSR-12.
Check or fix style
phpcs srcphp-cs-fixer fix srcTip^2.0 means at least 2.0, below 3.0. --no-dev skips development packages on servers.
TrapCommit composer.lock, so every developer and server installs the same versions.
Configuration
Read an env value
getenv('DB_HOST') TipKeep the code the same, and put what differs between environments in environment variables.
TrapThe production php.ini can leave $_ENV empty, so check getenv() too. Keep .env out of git.
Asked in interviews
AskedHow do you handle configuration in PHP applications?Design patterns & SOLID
the patterns PHP interviews ask you to explainSingleton or dependency injection
Allow one instance
private function __construct()Db::getInstance() Receive a dependency
__construct(Db $db)TipWith injection, a test can pass a mock. Type-hint an interface, not a concrete class.
TrapSingleton is global state and hides dependencies, so many call it an anti-pattern.
MVC and Repository
Name the MVC partsModel for data, view for HTML, controller for requests.
Hide SQL in a class
$users->find($id);TrapKeep controllers thin. Move business logic into models or service classes.
SOLID
Single responsibilityOne reason to change.
Open-closedAdd a class, not an edit.
Liskov substitutionA subtype replaces its base.
Interface segregationSmall interfaces beat one big one.
Dependency inversionDepend on abstractions.
TrapOver-applying SOLID adds an interface for every class. Apply it where code is expected to change.
Asked in interviews
AskedWhat are SOLID principles and how do they apply to PHP?Runtime & performance
what the server does, and how to make it fasterRequest life cycle and OPcache
Cap requests, restart workers
pm.max_childrenpm.max_requestsCompile at server start
opcache.preloadTurn on the JIT
opcache.jitSkip file checks
opcache.validate_timestamps=0 TipOPcache keeps opcodes in shared memory, so requests skip compiling. The JIT mostly helps CPU-heavy work.
TrapWith file checks off, every deploy must reset OPcache or restart PHP.
Memory and generators
Drop a large variable
unset($big);Free circular references
gc_collect_cycles(); Yield values on demand
yield $line;TipReference counting frees a value at zero, and a cycle collector handles cycles. Arrays use copy-on-write.
TrapA generator runs forward only, so you can't rewind it once it has started.
Caching layers
Cache dataAPCu on one server, Redis or Memcached across servers.
Reuse a response
Cache-ControlTipCache-aside reads the cache first. On a miss, it loads from the database and stores the result with a time to live.
TrapWhen a busy key expires, many requests hit the database. A rebuild lock stops this cache stampede.
Asked in interviews
AskedHow do you implement caching in PHP applications?Sync or async
Compare the modelsPHP-FPM blocks. Amp and Swoole run an event loop.
Pause a call stack (8.1+)
Fiber::suspend();TipOnly one fiber runs at a time, so fibers give concurrency, not parallelism.
TrapBlocking libraries stall the event loop, and long-running processes must not leak.
Asked in interviews
AskedWhat is the difference between synchronous and asynchronous PHP?Nothing matches. Try a shorter word, or clear the search.
Found this useful? Pass it on.
Pro · $10/mo
This sheet stays free. With Pro, you can:
- Every answer on this sheet. Read the full answer to all 82 questions it links, not just the 11 free ones.
- My sheet. The cards you star and the ones you miss in Quiz me, from every sheet, on one page to quiz and print.
- PDFs. Download this sheet and My sheet, laid out for A4, with every question a link to its answer.
- The rest of Pro. Every answer in the question library, and 1,000 AI credits a month.