PHP rounds divide sharply into two kinds. One is about the language as it was a decade ago; the other is about the language as it is, with strict types, enums, readonly properties and match expressions. It is worth being fluent in the modern answers and able to recognise the old ones.
Security comes up more here than in most language interviews, and for good reason - the three classic vulnerabilities all have one-line fixes that are shorter than the vulnerable version.
Answer each one out loud before you open it. An answer you have read is not an answer you can give under pressure, which is the only kind that counts.
Q1 What is the difference between == and === in PHP?
== compares after type juggling; === requires the same type and value.
PHP 8 made string-to-number comparison far saner, but == still surprises. Use === unless you have a specific reason not to.
What it is really testing. Whether you know PHP 8 changed the rules. Answers from old material are a giveaway.
Q2 What does declare(strict_types=1) do?
It stops PHP coercing argument and return types at function boundaries in that file.
Without it, passing '5' to a function expecting int silently works. It is per-file and opt-in for compatibility, and belongs at the top of every file you write.
What it is really testing. Whether you use it. It is the single highest-value habit in modern PHP.
Q3 What is the request lifecycle in traditional PHP?
Each request gets a fresh interpreter, runs the script, sends a response and discards everything.
This shared-nothing model means a memory leak lasts one request and a crash affects one user. Nothing persists except what you put in a database, cache or session.
What it is really testing. Whether you know what the model buys. It explains why PHP is unusually forgiving in production.
Q4 Why are superglobals dangerous?
Everything in $_GET, $_POST, $_COOKIE and $_SERVER is supplied by the client.
Hidden fields are not hidden, HTTP_HOST is attacker-controlled, and uploaded file names are chosen by the uploader. Validate on arrival, escape on output.
What it is really testing. Whether you treat all input as hostile rather than just obvious fields.
Q5 How do you prevent SQL injection?
Use prepared statements with bound parameters, never string concatenation.
The query and the data travel separately, so user input can never be parsed as SQL. It is also shorter than the concatenated version and reusable.
What it is really testing. Whether you know escaping functions are not an equivalent answer.
Q6 How do you prevent cross-site scripting?
Escape on output with htmlspecialchars, using ENT_QUOTES and UTF-8.
Escaping at the point of output is right because the correct escaping depends on context. A template engine that escapes by default removes the chance to forget.
What it is really testing. Whether you escape at output rather than on input. Escaping on input corrupts stored data.
Q7 What is CSRF and how do you stop it?
An attacker making a user's browser submit a request to your site - stopped with a per-session token in every form.
Checking the token proves the form came from your page. SameSite cookies help but are not a complete substitute across all browsers and flows.
What it is really testing. Whether you know it is about the browser's automatic cookie sending.
Q8 What is the difference between include and require?
require raises a fatal error if the file is missing; include emits a warning and continues.
The _once variants prevent double inclusion. In modern code both are largely replaced by Composer's autoloader.
What it is really testing. Whether you know autoloading made both mostly obsolete.
Q9 What is Composer and what does it actually give you?
A dependency manager, and an autoloader that maps namespaces to files.
PSR-4 autoloading means classes load on demand with no require statements at all. That is what made modern PHP frameworks possible.
What it is really testing. Whether you mention autoloading. Many answers stop at 'it installs packages'.
Q10 What is a namespace for?
Preventing name collisions between classes from different libraries.
It names things; it does not load them. The connection to files is PSR-4, which is why namespace and directory structure must agree - and why case differences break on Linux.
What it is really testing. Whether you know a namespace does not load anything. Autoloading is separate.
Q11 What is the difference between an abstract class and an interface in PHP?
An abstract class can carry state and partial implementation; an interface declares a contract only.
PHP allows one parent class and many interfaces, which is often what decides it. Type against interfaces so implementations can be substituted in tests.
What it is really testing. Whether you type against interfaces for testability rather than habit.
Q12 What are traits and when do they go wrong?
Reusable method bundles mixed into a class - and they go wrong when they depend on undeclared state.
A trait touching properties it does not define is an unenforced dependency. Several traits can also collide, requiring explicit conflict resolution.
What it is really testing. Whether you can name a failure mode. Traits are easy to overuse.
Q13 What is late static binding?
static:: resolves to the called class rather than the defining class, unlike self::.
It matters for inherited factory methods: self:: would always construct the parent, static:: constructs the subclass that was called.
What it is really testing. Whether you can give the factory-method example. It is the main real use.
Q14 What is the difference between Exception and Error in PHP?
Both implement Throwable; Error represents engine-level problems such as type errors.
Catching Exception alone misses type errors and division by zero. Catch Throwable when you genuinely want everything.
What it is really testing. Whether you know Throwable is the interface to catch for everything.
Q15 How should errors be configured in production?
display_errors off, log_errors on.
A stack trace on the page reveals file paths, PHP version and often database structure. The default on many shared hosts is exactly the wrong way round.
What it is really testing. Whether you know the default on shared hosting is often wrong.
Q16 How does PHP session handling work?
Data is stored server-side and the browser holds only an identifier in a cookie.
So the user cannot read or alter the data, only present the identifier - which makes protecting that identifier the whole security problem.
What it is really testing. Whether you know the data stays server-side. Many think the cookie holds it.
Q17 How do you secure a session cookie?
HttpOnly, Secure, SameSite, and regenerate the id on login.
Those four prevent script access, plaintext transmission, cross-site sending and session fixation respectively. None is on by default.
What it is really testing. Whether you can name what each flag prevents.
Q18 What is session fixation?
An attacker gives a victim a known session id before they sign in, then reuses it.
session_regenerate_id(true) at login issues a new id and invalidates the old one, which closes it completely.
What it is really testing. Whether you know regeneration at login is the fix.
Q19 How should passwords be stored?
With password_hash and verified with password_verify.
It uses a strong adaptive algorithm with a per-password salt handled automatically. Anything involving md5 or sha1 is wrong, and so is writing your own salting.
What it is really testing. Whether you reject hand-rolled salting. Writing your own is the wrong answer.
Q20 What is the difference between PDO and mysqli?
PDO supports many databases with one API; mysqli is MySQL-only but exposes some MySQL-specific features.
PDO's named parameters and consistent exception mode make it the usual default. Both support prepared statements, which is the part that matters.
What it is really testing. Whether you know both support prepared statements, which is the part that matters.
Q21 What does an array actually do in PHP?
It is an ordered map serving as list, dictionary, stack and queue at once.
That convenience hides a cost: a function receiving an array cannot tell which shape it expected, and a list that gains a string key serialises as an object.
What it is really testing. Whether you can name a cost. The convenience is obvious; the cost is not.
Q22 What is the difference between sorting functions like sort and usort?
sort reindexes and sorts values; asort preserves keys; usort takes a comparator.
Choosing one that reindexes when you needed the keys silently destroys the association, and nothing warns you.
What it is really testing. Whether you know which functions discard keys.
Q23 What are the magic methods and when should you use them?
__get, __set, __call and friends intercept access to undefined members.
They enable fluent library interfaces and make application code hard to navigate, because the method being called does not appear in the source.
What it is really testing. Whether you can argue against them. Convenience versus navigability is the trade.
Q24 What is the spread operator used for in PHP?
Unpacking an array into arguments, and collecting variadic arguments.
Since PHP 8.1 it also unpacks string-keyed arrays, which makes merging configuration arrays cleaner than array_merge in some cases.
What it is really testing. Whether you know it works for both packing and unpacking.
Q25 What are named arguments?
Passing arguments by parameter name rather than position.
They make calls with several optional parameters readable and let you skip defaults you do not care about. They also make parameter names part of your public API.
What it is really testing. Whether you know parameter names become part of your public API.
Q26 What is constructor property promotion?
Declaring and assigning constructor parameters to properties in one step.
It removes the most repetitive boilerplate in the language - the declaration, the parameter and the assignment collapse into one line.
What it is really testing. Whether you keep up with the language. This is recent and widely adopted.
Q27 What are readonly properties for?
Properties that can be set once during initialisation and never changed.
They give immutability without a wall of getters, and the compiler enforces it rather than a convention.
What it is really testing. Whether you value enforced immutability over a naming convention.
Q28 What are enums in PHP 8.1?
A type with a fixed set of named cases, optionally backed by a scalar.
They replace class constants and magic strings, and because the type is checked, an invalid value cannot reach the function at all.
What it is really testing. Whether you know they replace magic strings with a checked type.
Q29 What is the match expression?
An expression returning a value, using strict comparison with no fall-through.
Unlike switch it returns, does not need break, and throws if nothing matches - so a forgotten case fails loudly instead of silently.
What it is really testing. Whether you know an unmatched value throws rather than falling through silently.
Q30 What are nullable and union types?
?Type allows null; A|B allows either - both checked at the boundary.
They let signatures describe what actually happens rather than relying on docblocks that drift out of date.
What it is really testing. Whether you treat signatures as documentation the engine enforces.
Q31 What is the null-safe operator?
?-> which returns null instead of throwing when the left side is null.
It flattens the defensive null checks that used to surround chained calls, with the same caution as elsewhere: sometimes the error was the signal.
What it is really testing. Whether you know when suppressing a null is the wrong call.
Q32 What is an opcode cache and why does it matter?
It stores compiled bytecode so each file is parsed once rather than on every request.
Without it a shared-nothing model reparses everything per request. It is on by default in modern installations and the difference is large.
What it is really testing. Whether you know what the shared-nothing model costs without one.
Q33 What is the N+1 query problem?
A loop issuing one query per record, turning a hundred rows into a hundred and one round trips.
Eager loading the relationship reduces it to two. It is the dominant performance bug in database-backed PHP and dwarfs any micro-optimisation.
What it is really testing. Whether you recognise it as the dominant performance problem rather than a detail.
Q34 How do you optimise Composer for production?
Dump an optimised, authoritative classmap so the autoloader does no filesystem checks.
It removes thousands of file-existence checks per request. One command, and it is routinely forgotten on deployment.
What it is really testing. Whether you know the production step exists. It is routinely skipped.
Q35 What is dependency injection and does it need a framework?
Passing dependencies in rather than constructing them - and no, a constructor is enough.
A container only automates the wiring. The testability benefit comes from the constructor parameter, not from the container.
What it is really testing. Whether you separate the pattern from the tooling. A container is optional.
Q36 How do you test PHP code?
PHPUnit, with dependencies injected so they can be substituted.
A class that constructs its own database connection cannot be tested without one. The design decision and the testability are the same decision.
What it is really testing. Whether you connect testability to constructor design.
Q37 What are PSR standards?
Shared conventions for autoloading, coding style, HTTP messages, logging and containers.
They are why libraries from unrelated authors compose. A language with strong conventions is one where code can actually be shared.
What it is really testing. Whether you know why shared conventions matter for an ecosystem.
Q38 How do you handle file uploads safely?
Validate the type by content, never trust the supplied name, and store outside the web root.
The original filename is attacker-chosen, and checking the extension alone allows an executable to be uploaded and then requested.
What it is really testing. Whether you know the filename is attacker-controlled.
Q39 What is the difference between echo and print?
echo takes several arguments and returns nothing; print takes one and returns 1.
print being an expression means it can appear inside one, which is occasionally useful and mostly trivia. echo is marginally faster.
What it is really testing. Whether you know the difference is trivia. Overstating it is a small red flag.
Q40 Where is PHP a good choice and where is it not?
Good for server-rendered web applications and APIs; poor for long-running processes and heavy computation.
The deployment story is the simplest of any server language. The same shared-nothing model that makes it robust makes it unsuitable for holding state in memory.
What it is really testing. Whether you can say where it is a bad fit. Uncritical advocacy is a weaker answer.