PHP

PHP is a server-side scripting language used to build dynamic web apps. It processes requests on the server and returns HTML, JSON, or other responses.

PHP is easy to start, widely hosted, and has a huge ecosystem (Laravel, WordPress, etc.). It balances developer productivity, community support, and practical web performance.

A PHP script starts with <?php. In pure PHP files, the closing tag ?> is usually omitted to prevent accidental output.

Use echo (most common) or print. Both output text; echo is slightly more flexible and commonly preferred.

Variables begin with $ and are dynamically typed. Type depends on assigned value and can change later.

Traditionally dynamic, but modern PHP supports strong typing features. Type hints, return types, unions, and strict mode improve safety.

It enables strict scalar type checking in that file. Without it, PHP may coerce values between scalar types.

The scalar types are int, float, string, and bool. These are the basic single-value primitives in PHP.

Compound types include array, object, callable, and iterable. They represent structured or executable data forms.

Special types include null, resource, mixed, void, and never. They model absence, generic values, non-returning functions, and runtime handles.

Single-quoted strings are mostly literal. Double-quoted strings support interpolation and escape sequences.

Use the dot operator (.) to join strings. This is the standard PHP string concatenation syntax.

In double-quoted strings, variables are expanded automatically. It improves readability for simple dynamic strings.

Use // or # for single-line comments. Use /* ... */ for block comments.

Constants are immutable values defined with const or define(). They are used for fixed app-wide configuration values.

const is language-level and preferred in modern code. define() is runtime-based and useful in dynamic scenarios.

== compares values with type juggling. === compares both value and type strictly.

Strict comparison avoids unexpected coercion bugs. It makes conditions safer and easier to reason about.

Values like 0, "0", "", [], null, false are falsy. Most other non-empty/non-zero values are truthy.

Conditions are evaluated top-down. The first true branch executes; otherwise else runs.

switch selects code branch based on expression matching. Historically it uses loose comparison behavior.

match is an expression with strict matching and returned result. It is safer and avoids accidental fall-through.

PHP provides for, while, do...while, and foreach. Choose based on counter-based vs collection-based iteration needs.

Use foreach for arrays and Traversable objects. It is cleaner and less error-prone than manual index loops.

break immediately exits the nearest loop or switch. Useful when target condition is achieved early.

continue skips current iteration and moves to next one. Useful for ignoring unwanted items quickly.

A PHP array is an ordered map (key-value structure). It can behave like list, dictionary, stack, and more.

Indexed arrays use numeric keys. Associative arrays use string keys for named access.

Use array_key_exists("key", $arr). It detects key presence even when value is null.

isset($arr['k']) is false for missing keys and null values. array_key_exists('k', $arr) is true if key exists regardless of null.

Use sort helpers like sort, asort, ksort, usort based on needs. Pick value sort vs key sort and stable custom comparator carefully.

A function is reusable logic with inputs and optional return value. It improves modularity and avoids repetition.

Default parameters provide fallback values if argument is omitted. They simplify function calls for common cases.

It defines the expected output type of a function. This improves correctness and readability.

?Type means the value may be Type or null. Useful when absence is a valid result.

Union types allow multiple accepted types (e.g., int|string). They model flexible but explicit contracts.

Named arguments pass values by parameter name. They improve clarity, especially with many optional params.

Variadics (...$args) collect variable number of arguments. Useful for flexible APIs and wrappers.

Superglobals are built-in global arrays available everywhere. Examples: $_GET, $_POST, $_SERVER, $_SESSION.

$_GET contains URL query parameters. Use validation before trusting its values.

$_POST contains request body fields from POST forms. Treat all incoming data as untrusted input.

$_REQUEST combines GET/POST/COOKIE depending on configuration. Prefer explicit sources ($_GET or $_POST) for clarity and safety.

Validate expected format and sanitize when needed. Reject invalid input early and escape on output.

filter_var validates/sanitizes common values like email and URL. It provides standardized input checks.

Escapes special HTML chars to prevent script injection. Core output-escaping defense against XSS.

XSS is script injection into trusted web pages. It can steal sessions, deface UI, or run malicious actions.

Use context-aware escaping and secure templating defaults. Add CSP and never render raw untrusted HTML.

CSRF forces authenticated users to send unintended actions. Attack exploits browser auto-sent credentials.

Use anti-CSRF tokens and SameSite cookies. Optionally verify Origin/Referer for sensitive endpoints.

Sessions store user state on the server across requests. Client keeps only a session identifier cookie.

Call session_start() before any output is sent. Then read/write $_SESSION safely.

Cookies are small client-stored key/value data. Browser sends them automatically with matching requests.

Use setcookie() with options like secure, httponly, samesite. Avoid storing sensitive raw data in cookies.

Including loads and executes another PHP file. Used for shared templates, config, and reusable modules.

include gives warning if file missing; execution may continue. require gives fatal error; execution stops.

Ensures the same file is included only once. Prevents redeclaration errors and duplicate side effects.

Use file_get_contents() for straightforward file reads. For large files, prefer streaming line by line.

Use file_put_contents() for simple writes. Use append/lock flags when needed to avoid race issues.

Use file_exists("path"). Also validate readability/writability for robust handling.

Use DateTimeImmutable with explicit timezone. Avoid raw string math for reliable date operations.

OOP organizes code using classes and objects to model real-world behavior. It improves maintainability, reuse, and testability in medium/large applications.

A class is a blueprint that defines properties and methods. Objects are created from classes as usable runtime instances.

An object is an instance of a class with its own state. Multiple objects of one class can hold different data.

__construct() runs automatically when an object is created. It is used to initialize required dependencies or default state.

__destruct() runs when an object is about to be destroyed. It can release resources, though explicit cleanup is often preferred.

public is accessible everywhere, protected in class/subclasses, private only in same class. They enforce encapsulation and control object internals safely.

Inheritance lets a child class reuse/extend parent behavior via extends. Use it for true “is-a” relationships, not just code sharing.

A child class can redefine an inherited method with its own implementation. This enables polymorphic behavior for specialized logic.

final class cannot be extended; final method cannot be overridden. Use it to protect critical behavior/contracts from alteration.

An abstract class cannot be instantiated directly. It provides shared base logic and may force subclasses to implement abstract methods.

An interface defines method signatures without implementation. Classes implementing it must provide all declared methods.

Interface is a pure contract; abstract class can include shared code/state. Use interfaces for capabilities, abstract classes for common base behavior.

Traits allow horizontal code reuse across unrelated classes. They reduce duplication when inheritance is not appropriate.

Encapsulation hides internal state and exposes controlled methods. It prevents invalid object states and accidental external mutation.

Polymorphism allows different classes to be used via a common interface/type. Caller code stays generic while implementations vary.

Static members belong to the class, not object instances. Use for shared utility/state carefully to avoid global-coupling issues.

$this refers to the current object instance inside non-static methods. It gives access to instance properties and methods.

static:: resolves to the called class at runtime in inheritance chains. It enables inherited methods to instantiate/use subclass context correctly.

Special methods like __get, __set, __call, __toString hook object behavior. Use carefully—they are powerful but can hide complexity.

Autoloading loads class files automatically when referenced. Composer PSR-4 autoload is the standard approach in modern PHP projects.

Composer is PHP’s dependency manager and autoload generator. It installs packages, resolves versions, and standardizes project setup.

It is the project manifest describing dependencies, scripts, and autoload config. It is the central file for package and build behavior.

PSR means PHP Standards Recommendations from PHP-FIG. They improve code consistency and library interoperability.

PSR-4 maps namespaces to directory paths for autoloading. It removes manual include/require for class files.

A namespace isolates symbols (classes/functions/constants) to avoid naming conflicts. It is essential in larger projects and package ecosystems.

Use use Vendor\Package\ClassName; at file top. You can alias long names with as for readability.

Exceptions are objects representing runtime error conditions. They separate normal flow from failure-handling flow.

try runs risky code, catch handles thrown exceptions. finally always runs, usually for cleanup.

Custom exceptions express domain-specific failures clearly. They make error handling more intentional and meaningful.

Both implement Throwable; Exception is for application-level failures. Error generally represents engine/type/runtime programming issues.

Use PDO with exception mode and prepared statements. Never build SQL by concatenating raw user input.

Old mysql extension is removed and insecure by modern standards. PDO supports prepared statements and multiple databases consistently.

A prepared statement compiles SQL with placeholders first. Input values are bound separately, preventing SQL injection.

SQL injection is malicious input altering intended SQL query logic. It can expose, modify, or delete sensitive database data.

Use parameterized queries everywhere. Also apply validation and least-privilege DB accounts.

Use fetch() for one row or fetchAll() for multiple rows. Set fetch mode (e.g., PDO::FETCH_ASSOC) for predictable structure.

A transaction groups operations as one atomic unit. Either all succeed (commit) or all are undone (rollBack).

Use beginTransaction(), commit(), and rollBack(). Wrap multi-step critical writes to keep data consistent.

Use password_hash() and verify with password_verify(). Never store plaintext or use weak hashes like raw MD5/SHA1.

Database leaks become immediate account compromise. Hashed passwords significantly reduce attacker success.

Use password_verify($plain, $hash). It safely compares plaintext against the stored hash.

REST is an architectural style for resource-based HTTP APIs. It uses standard methods and stateless communication patterns.

GET (read), POST (create), PUT/PATCH (update), DELETE (remove). Method semantics improve API consistency and client understanding.

Common codes: 200, 201, 204, 400, 401, 403, 404, 409, 422, 500. Choose accurate status codes to communicate outcome clearly.

Set Content-Type: application/json header. Encode payload with json_encode() (prefer throw-on-error mode).

Use JSON_THROW_ON_ERROR to avoid silent failures. Catch JsonException and return controlled error response.

Middleware is a request/response pipeline layer. It handles cross-cutting concerns like auth, logging, and rate limits.

Routing maps HTTP method/path to handler/controller action. It is the entry-point dispatch mechanism of web apps.

Model handles data/domain, View handles presentation, Controller coordinates flow. It separates concerns for cleaner organization.

ORM maps database tables to objects/entities. It speeds development but requires query-awareness for performance.

ORM improves productivity with models, relations, and abstractions. But developers must still understand SQL/performance trade-offs.

It occurs when one query loads items, then one extra query per item runs. This creates major latency and DB load at scale.

Use eager loading, joins, or batching strategies. Always profile query counts on list endpoints.

Caching stores computed/fetched data for faster repeated access. It reduces DB hits, CPU work, and response time.

Common types: OPcache, app cache (Redis/Memcached), HTTP cache. Different layers solve different latency bottlenecks.

OPcache stores compiled PHP bytecode in memory. It avoids recompiling scripts on each request.

Write structured logs with context (request_id, user_id, level). Never log secrets, tokens, or sensitive personal data.

Dependency injection provides collaborators from outside the class. It reduces coupling and improves testability.

DI makes components easier to replace/mock. It supports clean architecture and modular design.

An IoC container resolves and wires object dependencies automatically. Frameworks use it to manage lifecycle and configuration centrally.

SOLID is a set of five OOP principles for maintainable, extensible systems. It reduces tight coupling and makes code easier to test and evolve.

Single Responsibility Principle means a class should have one reason to change. Each class should focus on one clear responsibility.

Open/Closed Principle: software entities should be open for extension. But they should be closed for direct modification of stable behavior.

Liskov Substitution Principle says subtypes must replace base types safely. Child classes must honor parent contracts and expectations.

Interface Segregation Principle prefers small, focused interfaces. Clients should not depend on methods they do not use.

Dependency Inversion Principle: depend on abstractions, not concrete classes. High-level policy and low-level details should both rely on interfaces.

Common patterns include Factory, Strategy, Repository, Adapter, Decorator, Observer, Builder. Patterns provide proven templates for recurring design problems.

Factory encapsulates object creation logic behind a clear API. It hides construction complexity and improves flexibility.

Strategy wraps interchangeable algorithms behind one interface. You can swap behavior at runtime without changing caller code.

Repository abstracts persistence behind domain-friendly operations. It isolates data access details from business logic.

DTO (Data Transfer Object) carries structured data between layers. It holds data only, usually without business behavior.

A value object is immutable and defined by its value, not identity. Two value objects with same values are considered equal logically.

Immutability prevents accidental state changes and side effects. It improves reasoning, concurrency safety, and debugging.

Closures are anonymous functions that can be assigned or passed around. They are useful for callbacks, pipelines, and functional-style code.

use imports variables from outer scope into a closure. It allows controlled variable capture for deferred execution.

Generators use yield to produce values lazily over time. They reduce memory usage when processing large datasets.

Use generators for streaming large files/records incrementally. They avoid loading entire data into memory at once.

iterable accepts arrays and Traversable objects. It is useful for APIs that consume loopable data sources.

Traversable is the base internal interface for iterable objects. Custom iterables typically implement Iterator or IteratorAggregate.

ArrayAccess allows objects to be accessed using array syntax. It enables \$obj['key'] behavior with custom logic.

SPL is the Standard PHP Library with core interfaces/classes. It includes iterators, data structures, exceptions, and utility tools.

Serialization converts data/object state into storable/transmittable format. It is used for caching, transport, or persistence scenarios.

Unserializing untrusted input is dangerous and can enable object injection. Avoid using it with external data sources.

Use JSON for public/external data exchange whenever possible. Use signed/encrypted tokens when integrity/confidentiality is required.

It exploits unsafe deserialization to trigger malicious object behavior. Attackers abuse magic methods and gadget chains in loaded classes.

Command injection occurs when user input reaches shell commands unsafely. It can lead to arbitrary command execution on the server.

Avoid shell execution when possible; use safe native APIs. If unavoidable, strict allowlists + escaping + least privilege are essential.

LFI/RFI happens when untrusted input controls included file paths. It can expose files or execute unintended code paths.

Never include files directly from raw user input. Use fixed maps/allowlists and keep remote includes disabled.

Validate MIME/signature/size/extension and randomize filenames. Store outside web root and scan uploads before processing.

Important headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy. They reduce browser-side attack surface significantly.

CORS is a browser policy controlling cross-origin resource access. Server response headers decide which origins/methods are allowed.

Use explicit trusted origin allowlists and minimal methods/headers. Do not use wildcard origin with credentialed requests.

Rate limiting restricts request volume per client/window. It protects APIs from abuse, brute force, and overload.

Idempotency means repeated same request has same final effect. Critical for safe retries in unreliable networks.

Optimistic locking checks version/timestamp before update. If version changed, update fails and client retries/merges.

Pessimistic locking acquires DB locks during transaction. It prevents concurrent conflicting writes but can reduce throughput.

Eventual consistency means replicas may temporarily diverge. Given time and no new writes, they converge to same state.

Queues move slow tasks (emails, exports, image processing) to background workers. They improve request latency and system resilience.

Handle retries, dead-letter queues, idempotency, and visibility timeouts. Add monitoring/alerting to detect stuck or failing jobs.

A web server (Nginx/Apache) forwards PHP requests to PHP-FPM worker pools. Workers execute scripts and return responses; pool sizing strongly affects latency and throughput.

Important settings: pm, pm.max_children, pm.max_requests, request_terminate_timeout, memory limits. Tune them based on traffic profile, script memory usage, and CPU capacity.

Vertical scaling increases resources on one server; simpler but has hard limits. Horizontal scaling adds instances behind a load balancer; better resilience and growth.

Stateless services make horizontal scaling and failover easy. Store session/state in shared systems (Redis/DB), not local process memory.

Deploy without user-visible interruption using rolling/blue-green/canary strategies. Use health checks, atomic release switch, and fast rollback paths.

Use backward-compatible, phased migrations that work across old/new app versions. Avoid long locks; add rollback plans and verify with production-like rehearsals.

Use secret managers or environment injection, never commit secrets in code. Rotate keys regularly and audit access with least-privilege controls.

The three pillars are logs, metrics, and traces. Together they answer what happened, how often, and where time was spent.

Track latency, error rate, throughput, saturation, DB latency, queue depth, and worker utilization. Use SLO-based dashboards and alert on symptom + cause indicators.

Tracing links spans across services using shared trace IDs. It reveals request path and bottlenecks across distributed systems.

Use profilers/APM (e.g., Blackfire, Xdebug profiler, Datadog, New Relic). Profile real bottlenecks first, then optimize the most expensive paths.

Typical issues: slow queries, N+1, heavy I/O, excessive serialization, cache misses. Also watch autoload overhead and large object graphs in hot paths.

A bounded context is a clear domain boundary with its own language and model. It reduces accidental coupling and clarifies ownership between teams/modules.

Keep domain logic at center; interact with external systems via ports/adapters. This improves testability and makes infrastructure replaceable.

CQRS separates write models (commands) from read models (queries). It improves scalability and clarity in complex, high-change domains.

Store state changes as immutable events instead of current-state rows only. Current state is reconstructed by replaying event history.

Pros: full audit trail, temporal debugging, flexible projections. Cons: higher complexity, schema evolution burden, and tooling/ops overhead.

Use semantic versioning, explicit deprecation windows, and migration guides. Protect contracts with integration/contract tests and staged rollout policies.

Use timeouts, retries with backoff + jitter, circuit breakers, and idempotency keys. Define fallback behavior and monitor dependency health continuously.

Expertise means building secure, observable, scalable, maintainable systems. It combines strong design, delivery discipline, and production operational excellence.