Question 1

What is PHP and why is it used for server-side web development?

Accepted Answer

PHP (Hypertext Preprocessor) is an open-source, server-side scripting language specifically engineered for web development. When a client requests a PHP page, the server's PHP engine parses and executes the script, queries databases if needed, and returns pure HTML/JSON to the client browser. Its major strengths include native database drivers, broad hosting support, and seamless HTML embedding. Code Example: $greeting"; ?>

Question 2

What is the difference between echo and print in PHP?

Accepted Answer

Both echo and print output strings, but with key differences:
1. 'echo' has no return value (void) and can accept multiple comma-separated arguments.
2. 'print' always returns an integer value (1), meaning it can be used inside expressions.
3. 'echo' is marginally faster than 'print' because it does not compute a return value.
Code Example:
echo 'Hello', ' ', 'World!'; // Valid with echo
$res = print('Test');         // Valid: $res equals 1

Question 3

How do variables and variable scoping work in PHP?

Accepted Answer

Variables in PHP start with the '$' symbol and are dynamically typed. Scope rules in PHP are strictly divided into Local (defined within a function), Global (defined outside functions), and Static (retains value across function calls). Unlike JavaScript, global variables are not automatically accessible inside functions unless explicitly declared via the 'global' keyword or accessed via the $GLOBALS superglobal.
Code Example:
$globalVar = 100;

function testScope() {
    global $globalVar;
    static $counter = 0;
    $counter++;
    return $globalVar + $counter;
}

Question 4

What are the differences between == and === operators in PHP?

Accepted Answer

The loose equality operator '==' performs type coercion before comparison, converting operand types to match. The strict equality operator '===' compares both value and data type without any coercion. For example, '0 == false' evaluates to true, but '0 === false' evaluates to false. In production, strict comparison (===) is recommended to avoid subtle bugs.
Code Example:
$num = 0;
$bool = false;

var_dump($num == $bool);  // bool(true) - loose comparison
var_dump($num === $bool); // bool(false) - int !== bool

Question 5

What are PHP Superglobals? List the most common ones.

Accepted Answer

Superglobals are built-in arrays in PHP that are globally available in all scopes across scripts without requiring the 'global' keyword. Common superglobals include:
- $_GET: Parameters passed via HTTP GET query string.
- $_POST: Form data sent via HTTP POST body.
- $_REQUEST: Combination of $_GET, $_POST, and $_COOKIE.
- $_SERVER: Server, execution environment, and header information.
- $_SESSION: Session variables for state persistence.
- $_COOKIE: HTTP cookie values sent by the client.
- $_FILES: Uploaded file metadata.
- $_ENV: Environment variables.
- $GLOBALS: References all global variables.

Question 6

What is the difference between include, require, include_once, and require_once?

Accepted Answer

These statements import and evaluate external files:
1. 'include': Generates an E_WARNING if the file is missing; execution continues.
2. 'require': Generates an E_COMPILE_ERROR (fatal error) if the file is missing; execution halts immediately.
3. 'include_once' & 'require_once': Ensure the target file is loaded only once across the entire request lifecycle, preventing duplicate function or class re-declaration errors.
Code Example:
// Essential configuration file
require_once __DIR__ . '/config.php';

// Optional template component
include __DIR__ . '/partials/banner.php';

Question 7

How do Indexed Arrays, Associative Arrays, and Multidimensional Arrays differ in PHP?

Accepted Answer

In PHP, arrays are ordered maps:
- Indexed Arrays: Use auto-incrementing numeric indices starting at 0.
- Associative Arrays: Use named string keys to represent key-value mappings.
- Multidimensional Arrays: Contain one or more nested arrays as elements.
Code Example:
$indexed = ['Apple', 'Banana', 'Cherry'];
$assoc = ['name' => 'Alice', 'role' => 'Engineer'];
$multi = [
    ['id' => 1, 'name' => 'Server Alpha'],
    ['id' => 2, 'name' => 'Server Beta']
];

Question 8

How do sessions and cookies work in PHP, and how do they differ?

Accepted Answer

Cookies store data on the client's browser and are transmitted with each HTTP request header. They have size limitations (~4KB) and can be inspected or modified by the user. Sessions store sensitive data on the server filesystem or Redis; only an encrypted session identifier (PHPSESSID) is stored in a client cookie. Sessions begin with session_start().
Code Example:
session_start();
$_SESSION['user_id'] = 42;

// Setting an HTTP-only secure cookie
setcookie('theme', 'dark', [
    'expires' => time() + 86400 * 30,
    'path' => '/',
    'secure' => true,
    'httponly' => true,
    'samesite' => 'Strict'
]);

Question 9

What are PHP data types and how does type casting work?

Accepted Answer

PHP supports scalar types (int, float, string, bool), compound types (array, object), and special types (null, resource). PHP is weakly typed but supports explicit type casting using syntax like `(int)$str` or `(string)$number`. PHP 7+ also introduced strict scalar type declarations via `declare(strict_types=1);` at the top of files.
Code Example:
declare(strict_types=1);

$price = '49.99';
$intPrice = (int)$price; // 49
$floatPrice = (float)$price; // 49.99

Question 10

What are string manipulation functions in PHP and how is string interpolation handled?

Accepted Answer

Double-quoted strings (`"..."`) evaluate escape sequences and parse variables (interpolation). Single-quoted strings (`'...'`) treat characters literally. Essential string functions include `strlen()`, `strpos()`, `substr()`, `str_replace()`, `trim()`, and PHP 8's `str_contains()`, `str_starts_with()`, and `str_ends_with()`.
Code Example:
$name = 'Jane';
echo "Hello, {$name}!"; // Hello, Jane!
echo 'Hello, $name!';   // Hello, $name!

// PHP 8 helper
if (str_contains('api.example.com', 'api')) {
    // Host match
}

Question 11

How do you handle file uploads securely in PHP?

Accepted Answer

Uploaded files are populated into `$_FILES`. To handle uploads securely:
1. Verify `$_FILES['file']['error'] === UPLOAD_ERR_OK`.
2. Validate file size against an application limit.
3. Validate the real MIME type using `mime_content_type()` or `finfo_file()`, never relying solely on the client file extension.
4. Sanitize and randomize filename using `bin2hex(random_bytes(16))`.
5. Move the temporary file using `move_uploaded_file()` to a directory outside the web root.
Code Example:
$finfo = new finfo(FILEINFO_MIME_TYPE);
$mime = $finfo->file($_FILES['avatar']['tmp_name']);
$allowed = ['image/jpeg', 'image/png', 'image/webp'];

if (in_array($mime, $allowed, true)) {
    $safeName = bin2hex(random_bytes(16)) . '.png';
    move_uploaded_file($_FILES['avatar']['tmp_name'], '/var/uploads/' . $safeName);
}

Question 12

What is the difference between GET and POST HTTP methods in PHP?

Accepted Answer

GET sends parameters appended to the URL query string, is limited in length (~2048 chars), is cached by browsers, and should only be used for idempotent read operations. POST transmits data inside the HTTP request payload body, has no URL length limit, supports binary data, and is used for state-altering operations like creating or mutating records.
Code Example:
// Reading GET query param
$search = filter_input(INPUT_GET, 'q', FILTER_SANITIZE_SPECIAL_CHARS);

// Reading POST payload
$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);

Question 13

How do ternary operators and the null coalescing operator (??) work in PHP?

Accepted Answer

The ternary operator `condition ? trueVal : falseVal` evaluates boolean logic. The null coalescing operator `??` checks if a variable exists AND is not null without triggering an 'undefined array key' warning. PHP 7.4 also added the null coalescing assignment operator `??=`.
Code Example:
// Traditional ternary
$status = $isActive ? 'Active' : 'Inactive';

// Null coalescing: fallback if $_GET['page'] is unset or null
$page = $_GET['page'] ?? 1;

// Null coalescing assignment
$config['timeout'] ??= 30;

Question 14

What are Constants in PHP and how are define() and const different?

Accepted Answer

Constants hold immutable values that cannot change during script execution. In PHP:
- `define()` defines constants at runtime and can be used inside conditional blocks and functions.
- `const` defines constants at compile time, is faster, and can be declared inside class definitions as class constants.
Code Example:
define('API_BASE', 'https://api.example.com');

class Config {
    public const MAX_RETRIES = 3;
}

Question 15

How do error reporting and error levels work in PHP?

Accepted Answer

PHP classifies errors into levels: E_ERROR (fatal), E_WARNING (non-fatal notice), E_NOTICE (minor run-time notice), and E_DEPRECATED. In development, errors should be displayed using `error_reporting(E_ALL)` and `ini_set('display_errors', '1')`. In production, `display_errors` MUST be '0' and errors should be written to logs (`log_errors = 1`) to prevent leaking server internal paths.
Code Example:
error_reporting(E_ALL);
ini_set('display_errors', '0');
ini_set('log_errors', '1');
ini_set('error_log', '/var/log/php_errors.log');

Question 16

Explain the four pillars of Object-Oriented Programming in PHP.

Accepted Answer

1. Encapsulation: Grouping data and methods into classes with access modifiers (private, protected, public).
2. Inheritance: Allowing a child class to inherit properties and methods from a parent class via `extends`.
3. Polymorphism: Allowing child classes to provide specific implementations of methods defined in interfaces or parent classes.
4. Abstraction: Hiding implementation details using abstract classes and interfaces.
Code Example:
interface PaymentGateway {
    public function process(float $amount): bool;
}

class StripeGateway implements PaymentGateway {
    public function process(float $amount): bool {
        // Concrete implementation
        return true;
    }
}

Question 17

What is the difference between an Interface and an Abstract Class in PHP?

Accepted Answer

An Interface defines a contract consisting only of public method signatures without any implementation (until PHP 8 attributes), and a class can implement multiple interfaces. An Abstract Class can contain both abstract methods (without body) and concrete methods (with full implementations) plus class properties, but a class can inherit from only one abstract class.
Code Example:
abstract class BaseRepository {
    protected PDO $db;
    public function __construct(PDO $db) { $this->db = $db; }
    abstract public function find(int $id): ?array;
}

interface Loggable {
    public function log(string $msg): void;
}

Question 18

What are PHP Magic Methods? Explain __construct, __destruct, and __get/__set.

Accepted Answer

Magic methods in PHP are special methods prefixed with double underscores that automatically trigger in response to specific lifecycle events or operations:
- `__construct()`: Invoked when a new object instance is created.
- `__destruct()`: Invoked when all references to an object are removed or during script shutdown.
- `__get($prop)` and `__set($prop, $val)`: Invoked when reading or writing inaccessible (private/protected) or non-existent properties.
- `__call()` and `__callStatic()`: Invoked when invoking inaccessible methods.
- `__toString()`: Invoked when an object is treated as a string.
Code Example:
class DataContainer {
    private array $data = [];
    
    public function __get(string $name) {
        return $this->data[$name] ?? null;
    }
    
    public function __set(string $name, $value) {
        $this->data[$name] = $value;
    }
}

Question 19

What are Traits in PHP and why are they used?

Accepted Answer

PHP supports single inheritance (a class can only extend one parent class). Traits provide a mechanism for horizontal code reuse across independent classes without requiring inheritance hierarchy complexity. Traits can contain methods, abstract methods, and properties.
Code Example:
trait Timestampable {
    public function getCreatedAt(): string {
        return date('Y-m-d H:i:s');
    }
}

class User {
    use Timestampable;
}

class Post {
    use Timestampable;
}

Question 20

What is PDO (PHP Data Objects) and why is it preferred over mysqli?

Accepted Answer

PDO provides a database abstraction layer supporting 12+ database drivers (MySQL, PostgreSQL, SQLite, Oracle, etc.), whereas mysqli only supports MySQL databases. PDO supports named parameter binding, consistent exception handling via `PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION`, and robust transaction management.
Code Example:
$dsn = 'mysql:host=localhost;dbname=shop;charset=utf8mb4';
$pdo = new PDO($dsn, 'user', 'secret', [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
]);

$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');
$stmt->execute(['email' => $userEmail]);
$user = $stmt->fetch();

Question 21

How do Prepared Statements protect against SQL Injection in PHP?

Accepted Answer

SQL injection occurs when untrusted user input is directly concatenated into SQL queries. Prepared statements separate the SQL query structure from the data parameters. The database engine compiles and optimizes the SQL template first. When parameters are sent later, they are treated strictly as literal scalar values, making it impossible for input to inject executable SQL commands.
Code Example:
// VULNERABLE TO SQL INJECTION:
// $pdo->query("SELECT * FROM users WHERE username = '{$_POST['user']}'");

// SECURE WITH PREPARED STATEMENT:
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :user');
$stmt->execute(['user' => $_POST['user']]);

Question 22

What is Dependency Injection (DI) and how does an Inversion of Control (IoC) Container work in PHP?

Accepted Answer

Dependency Injection is a design pattern where an object receives its dependencies from outside rather than creating them internally using `new`. This adheres to the Dependency Inversion Principle (SOLID). An IoC Container automatically resolves and injects dependencies using reflection and type hints.
Code Example:
class OrderService {
    private PaymentGateway $gateway;
    
    // Injected via constructor
    public function __construct(PaymentGateway $gateway) {
        $this->gateway = $gateway;
    }
    
    public function checkout(float $total): void {
        $this->gateway->process($total);
    }
}

Question 23

What are PSR standards in modern PHP development?

Accepted Answer

PHP Standards Recommendations (PSRs) are established by the PHP-FIG (PHP Framework Interop Group) to enable cross-library interoperability. Key standards include:
- PSR-1 & PSR-12: Coding style guide and syntax standards.
- PSR-4: Autoloading standard mapping namespaces directly to directory file paths.
- PSR-7 & PSR-15: HTTP Message interfaces and HTTP Server Request Handlers (Request, Response, Middleware).
- PSR-11: Container interface for Dependency Injection.
- PSR-18: HTTP Client interface.

Question 24

How does Composer autoloading work under PSR-4?

Accepted Answer

Composer uses PSR-4 autoloading defined in `composer.json`. It maps a namespace prefix to a directory path. When a class like `App\Services\UserService` is referenced, Composer's autoloader replaces the namespace prefix with the mapped directory, converts backslashes to directory separators, appends `.php`, and requires the file automatically on demand.
Code Example:
/* composer.json */
{
    "autoload": {
        "psr-4": {
            "App\": "src/"
        }
    }
}

Question 25

What is the difference between static methods/properties and instance methods/properties?

Accepted Answer

Instance methods and properties belong to a specific object instance created with `new`, accessed via `$this->`. Static methods and properties belong to the class definition itself, accessed via `self::` or `ClassName::` without instantiation. Static properties share state across all instances, which can make unit testing and mocking more difficult if overused.
Code Example:
class Logger {
    public static int $logCount = 0;
    
    public static function log(string $msg): void {
        self::$logCount++;
        echo "[LOG]: $msg";
    }
}

Question 26

Explain the Singleton Design Pattern in PHP and its trade-offs.

Accepted Answer

The Singleton pattern ensures a class has only one instance and provides a global access point to it. It uses a private constructor, private clone method, and a static method `getInstance()`. While useful for resource managers like database connections, it introduces global state and tight coupling, making testing harder compared to Dependency Injection.
Code Example:
class Database {
    private static ?Database $instance = null;
    private function __construct() {}
    private function __clone() {}
    
    public static function getInstance(): Database {
        if (self::$instance === null) {
            self::$instance = new self();
        }
        return self::$instance;
    }
}

Question 27

How does Exception handling work in modern PHP?

Accepted Answer

In modern PHP (7+), both userland Exceptions and engine fatal errors implement the `Throwable` interface. Code is wrapped in `try { ... } catch (SpecificException $e) { ... } finally { ... }`. Custom exceptions allow domain-specific error handling, and the `finally` block always executes for cleanup regardless of whether an error was thrown.
Code Example:
try {
    $record = $repo->findById($id);
    if (!$record) {
        throw new NotFoundException('Resource missing');
    }
} catch (NotFoundException $e) {
    http_response_code(404);
    echo json_encode(['error' => $e->getMessage()]);
} catch (Throwable $e) {
    http_response_code(500);
    error_log($e->getMessage());
} finally {
    $db->disconnect();
}

Question 28

What are Anonymous Classes in PHP?

Accepted Answer

Introduced in PHP 7, anonymous classes allow developers to create lightweight, one-off class instances on the fly without declaring a named class. They are particularly useful for testing mocks, implementing quick interfaces, or passing temporary strategy objects.
Code Example:
$logger = new class implements LoggerInterface {
    public function log(string $msg): void {
        echo $msg;
    }
};

Question 29

What is Late Static Binding (LSB) and how does static:: differ from self::?

Accepted Answer

`self::` always refers to the class in which the method was originally written (resolved at compile time). `static::` enables Late Static Binding: it resolves to the runtime calling class (the class that was called at runtime). This allows inherited static methods to access overridden static properties in child classes.
Code Example:
class Model {
    public static string $table = 'base';
    public static function getTable(): string {
        return static::$table; // Resolves calling class!
    }
}

class User extends Model {
    public static string $table = 'users';
}

echo User::getTable(); // Outputs 'users'

Question 30

What are Generators and the 'yield' keyword in PHP?

Accepted Answer

Generators allow developers to write functions that can iterate through datasets without building and loading an entire array in memory. When a generator encounters `yield`, it provides the current value and pauses execution, resuming only when the caller asks for the next item. This reduces memory usage from gigabytes to megabytes when processing large CSV files or database streams.
Code Example:
function readHugeLogFile(string $path): Generator {
    $handle = fopen($path, 'r');
    while (($line = fgets($handle)) !== false) {
        yield trim($line);
    }
    fclose($handle);
}

// Consumes negligible memory:
foreach (readHugeLogFile('access.log') as $line) {
    // process line
}

PHP Backend Interview Master

Difficulty Filters

Tools & Options

What is PHP and why is it used for server-side web development?

What is the difference between echo and print in PHP?

How do variables and variable scoping work in PHP?

What are the differences between == and === operators in PHP?

What are PHP Superglobals? List the most common ones.

What is the difference between include, require, include_once, and require_once?

How do Indexed Arrays, Associative Arrays, and Multidimensional Arrays differ in PHP?

How do sessions and cookies work in PHP, and how do they differ?

What are PHP data types and how does type casting work?

What are string manipulation functions in PHP and how is string interpolation handled?

How do you handle file uploads securely in PHP?

What is the difference between GET and POST HTTP methods in PHP?

How do ternary operators and the null coalescing operator (??) work in PHP?

What are Constants in PHP and how are define() and const different?

How do error reporting and error levels work in PHP?

Explain the four pillars of Object-Oriented Programming in PHP.

What is the difference between an Interface and an Abstract Class in PHP?

What are PHP Magic Methods? Explain __construct, __destruct, and __get/__set.

What are Traits in PHP and why are they used?

What is PDO (PHP Data Objects) and why is it preferred over mysqli?

How do Prepared Statements protect against SQL Injection in PHP?

What is Dependency Injection (DI) and how does an Inversion of Control (IoC) Container work in PHP?

What are PSR standards in modern PHP development?

How does Composer autoloading work under PSR-4?

What is the difference between static methods/properties and instance methods/properties?

Explain the Singleton Design Pattern in PHP and its trade-offs.

How does Exception handling work in modern PHP?

What are Anonymous Classes in PHP?

What is Late Static Binding (LSB) and how does static:: differ from self::?

What are Generators and the 'yield' keyword in PHP?

What are Constructor Property Promotion and Readonly Properties in PHP 8?

How does the 'match' expression differ from 'switch' in PHP 8?

What is the Nullsafe Operator (?->) in PHP 8?

What are PHP 8 Attributes and how do they replace DocBlock annotations?

What are Named Arguments in PHP 8 and what benefits do they provide?

What are Union Types and Intersection Types in PHP 8.0 & 8.2?

Explain the PHP OPcache and how it boosts performance.

What is the PHP 8 JIT (Just-In-Time) Compiler and how does it work?

What are Fibers in PHP 8.1 and how do they relate to concurrency?

What are Enums in PHP 8.1 and how do Pure and Backed Enums differ?

How does PHP Garbage Collection and reference counting work?

How do you profile and debug memory leaks in long-running PHP worker processes?

What is Preloading in PHP 7.4+ and how does it optimize framework boot time?

What are Readonly Classes in PHP 8.2?

What is the difference between PHP-FPM, mod_php, and modern async runtimes like Swoole or RoadRunner?

How do you prevent Cross-Site Scripting (XSS) attacks in PHP?

How does Cross-Site Request Forgery (CSRF) work and how do you mitigate it in PHP?

Why should you use password_hash() and password_verify() instead of md5 or sha1?

What is Timing Attack vulnerability and why is hash_equals() necessary?

What is PHP Type Juggling and how can it cause critical security authentication bypasses?

What is Insecure Deserialization in PHP and how does it lead to Remote Code Execution?

How do you protect PHP applications against Server-Side Request Forgery (SSRF)?

What is Session Fixation and Session Hijacking, and how do you protect against them in PHP?

What are Variable Variables ($$var) in PHP and why are they considered risky?

What is the difference between pass-by-value and pass-by-reference in PHP?

How do you securely handle Command Execution in PHP and avoid Command Injection?

What is Path Traversal (Directory Traversal) and how do you prevent it in PHP?

How does the spaceship operator (<=>) work in PHP?

What is an Anonymous Function and what is the difference between function() use() and fn()?

What are best practices for securing API authentication with JWT in PHP?

Technical Interview Mastery Blueprint

1. The Engineering STAR Technique

2. Defending Architectural Trade-Offs

3. Clean Code & Edge-Case Proactivity

4. Antipatterns to Avoid

Explore Related Tools

Ai Ml Interview

Ai Theory Interview

Angular Interview Questions

Artificial Intelligence Interview

Aws Interview Questions

Bitbucket Interview

Follow Us

Our Tools

Our Company

Special Tools

What are PHP Magic Methods? Explain construct, destruct, and get/set.