PHP on Software Engineering Learning Paths

Syntax, Types, and the Runtime

Mon, 01 Jan 0001 00:00:00 +0000

The PHP Runtime#

PHP originally stood for “Personal Home Page” (now “PHP: Hypertext Preprocessor” — a recursive acronym). It’s an interpreted language compiled to opcodes at request time, executed by the Zend Engine virtual machine.

Execution Model#

flowchart TD
 SRC[".php source file"] --> LEXER["Lexer (Tokenizer)"]
 LEXER --> PARSER["Parser (AST)"]
 PARSER --> COMPILER["Compiler"]
 COMPILER --> OPCODES["Opcodes"]
 OPCODES --> VM["Zend VM"]
 VM --> OUTPUT["Output (HTML, JSON, etc.)"]
 
 OPCODES -.->|"Cached by OPcache"| CACHE["Shared Memory"]
 CACHE -.->|"Subsequent requests"| VM

Key insight: Without OPcache, PHP re-compiles every file on every request. With OPcache (enabled by default since PHP 5.5), compiled opcodes persist in shared memory across requests — massive performance win.

Control Flow and Functions

Mon, 01 Jan 0001 00:00:00 +0000

Conditionals#

if / elseif / else#

<?php
if ($age >= 18) {
 echo "Adult";
} elseif ($age >= 13) {
 echo "Teenager";
} else {
 echo "Child";
}

match Expression (PHP 8.0+)#

match is a strict-comparison alternative to switch that returns a value and doesn’t fall through:

<?php
$status = match ($code) {
 200 => 'OK',
 301 => 'Moved Permanently',
 404 => 'Not Found',
 500 => 'Internal Server Error',
 default => 'Unknown',
};

// match with complex conditions
$label = match (true) {
 $temp > 35 => 'Hot',
 $temp > 20 => 'Warm',
 $temp > 10 => 'Cool',
 default => 'Cold',
};

match vs switch:

Feature	switch	match
Comparison	Loose (`==`)	Strict (`===`)
Fall-through	Yes (needs `break`)	No
Returns value	No	Yes
Exhaustive	No	Yes (throws `UnhandledMatchError`)

Ternary and Short Ternary#

<?php
$label = $count > 0 ? 'has items' : 'empty';

// Short ternary (Elvis operator) — returns left if truthy, else right
$name = $input ?: 'Anonymous';
// Equivalent to: $name = $input ? $input : 'Anonymous';

Loops#

for#

<?php
for ($i = 0; $i < 10; $i++) {
 echo $i;
}

foreach#

The workhorse loop for arrays:

Arrays and Strings

Mon, 01 Jan 0001 00:00:00 +0000

Arrays#

PHP arrays are the most versatile data structure in the language. They’re actually ordered hash maps — they can act as lists, dictionaries, stacks, queues, sets, and more.

Creating Arrays#

<?php
// Short syntax (preferred)
$fruits = ['apple', 'banana', 'cherry'];

// Associative array (key => value)
$person = [
 'name' => 'Alice',
 'age' => 30,
 'city' => 'Barcelona',
];

// Mixed keys (possible but confusing — avoid)
$mixed = [0 => 'zero', 'key' => 'value', 1 => 'one'];

// Nested arrays
$matrix = [
 [1, 2, 3],
 [4, 5, 6],
 [7, 8, 9],
];

Accessing and Modifying#

<?php
$fruits[0]; // 'apple'
$person['name']; // 'Alice'
$matrix[1][2]; // 6

// Append
$fruits[] = 'date'; // adds at next integer key

// Modify
$person['age'] = 31;

// Remove
unset($fruits[1]); // removes 'banana', does NOT reindex!
// After unset: [0 => 'apple', 2 => 'cherry', 3 => 'date']

// Reindex after unset
$fruits = array_values($fruits);

Array Destructuring#

<?php
// List assignment (positional)
[$first, $second] = ['hello', 'world'];

// Skip elements
[, , $third] = [1, 2, 3]; // $third = 3

// Associative destructuring
['name' => $name, 'age' => $age] = $person;

// In foreach
$points = [['x' => 1, 'y' => 2], ['x' => 3, 'y' => 4]];
foreach ($points as ['x' => $x, 'y' => $y]) {
 echo "($x, $y) ";
}

Essential Array Functions#

Searching and Filtering#

<?php
in_array('apple', $fruits); // true (loose comparison)
in_array('apple', $fruits, true); // true (strict — preferred)
array_key_exists('name', $person); // true
array_search('cherry', $fruits); // returns key or false

// Filter with callback
$adults = array_filter($users, fn($u) => $u['age'] >= 18);

// Filter without callback removes falsy values
$clean = array_filter([0, '', null, 'hello', false, 42]); // ['hello', 42]

Transforming#

<?php
// Map: transform each element
$upper = array_map(fn($s) => strtoupper($s), $fruits);

// Map with keys (use array_map with null + multiple arrays, or foreach)
$result = [];
foreach ($data as $key => $value) {
 $result[$key] = transform($value);
}

// Reduce: fold into a single value
$total = array_reduce($prices, fn($carry, $item) => $carry + $item, 0);

// Column: extract a single column from nested arrays
$names = array_column($users, 'name');
$indexed = array_column($users, null, 'id'); // re-index by 'id' field

Sorting#

<?php
sort($arr); // by value, reindex
rsort($arr); // reverse, reindex
asort($arr); // by value, preserve keys
arsort($arr); // reverse by value, preserve keys
ksort($arr); // by key
krsort($arr); // reverse by key

// Custom sort
usort($users, fn($a, $b) => $a['age'] <=> $b['age']);

// Sort by multiple criteria
usort($users, function ($a, $b) {
 return $a['city'] <=> $b['city']
 ?: $a['name'] <=> $b['name'];
});

Combining and Splitting#

<?php
$merged = array_merge($a, $b); // reindexes numeric keys
$combined = $a + $b; // preserves keys, left wins on conflict
$replaced = array_replace($a, $b); // right wins on conflict

$chunk = array_chunk($large, 100); // split into groups of 100
$slice = array_slice($arr, 2, 5); // 5 elements starting at index 2

$keys = array_keys($person); // ['name', 'age', 'city']
$values = array_values($person); // ['Alice', 30, 'Barcelona']
$flipped = array_flip($arr); // swap keys and values
$unique = array_unique($arr); // remove duplicates

The Spread Operator in Arrays (PHP 7.4+)#

<?php
$first = [1, 2, 3];
$second = [4, 5, 6];
$all = [...$first, ...$second]; // [1, 2, 3, 4, 5, 6]

// Works with named keys (PHP 8.1+)
$defaults = ['color' => 'blue', 'size' => 'M'];
$override = ['color' => 'red'];
$config = [...$defaults, ...$override]; // ['color' => 'red', 'size' => 'M']

Strings#

String Functions (Most Common)#

<?php
strlen($str); // Length (bytes, not characters!)
mb_strlen($str); // Length (multibyte-safe — use this for UTF-8)
strtolower($str); // Lowercase
strtoupper($str); // Uppercase
trim($str); // Strip whitespace from both ends
ltrim($str); rtrim($str); // Left/right trim

str_contains($hay, $needle); // PHP 8.0+ (previously: strpos !== false)
str_starts_with($str, 'http'); // PHP 8.0+
str_ends_with($str, '.php'); // PHP 8.0+

substr($str, 0, 5); // First 5 characters
str_replace('old', 'new', $str); // Replace all occurrences
str_pad($str, 10, '0', STR_PAD_LEFT); // Left-pad with zeros

explode(',', $csv); // Split string → array
implode(', ', $arr); // Join array → string

sprintf('Hello, %s! You are %d.', $name, $age); // Formatted string

String Interpolation#

<?php
$name = "World";

// Simple variable
echo "Hello, $name!";

// Complex expressions need curly braces
echo "Item: {$items[0]->name}";
echo "Result: {$obj->getLabel()}"; // Method calls need braces

// Array access in strings
echo "Value: {$config['key']}";

Regular Expressions (PCRE)#

<?php
// Match
preg_match('/^[a-z]+$/i', $input, $matches);

// Match all
preg_match_all('/\d+/', $text, $matches);

// Replace
$clean = preg_replace('/\s+/', ' ', $text);

// Replace with callback
$result = preg_replace_callback(
 '/\{(\w+)\}/',
 fn($m) => $replacements[$m[1]] ?? $m[0],
 $template
);

// Split
$words = preg_split('/[\s,;]+/', $text);

Multibyte Strings (UTF-8)#

PHP’s standard string functions are byte-oriented. For UTF-8 text, always use mb_* functions:

Object-Oriented PHP

Mon, 01 Jan 0001 00:00:00 +0000

Classes and Objects#

<?php
class User
{
 // Properties with visibility and types
 private string $name;
 private string $email;
 private readonly int $id; // readonly (PHP 8.1+) — set once, never changed

 // Constructor with promotion (PHP 8.0+)
 public function __construct(
 private string $name,
 private string $email,
 private readonly int $id = 0,
 ) {}

 // Methods
 public function getDisplayName(): string
 {
 return "{$this->name} <{$this->email}>";
 }

 // Static methods
 public static function createGuest(): self
 {
 return new self('Guest', 'guest@example.com');
 }
}

$user = new User(name: 'Alice', email: 'alice@example.com', id: 1);
$guest = User::createGuest();

Constructor Property Promotion (PHP 8.0+)#

Eliminates the boilerplate of declaring properties, assigning in constructor:

<?php
// Before PHP 8.0 (verbose)
class Point {
 private float $x;
 private float $y;
 
 public function __construct(float $x, float $y) {
 $this->x = $x;
 $this->y = $y;
 }
}

// PHP 8.0+ (promoted — property declaration, type, and assignment in one)
class Point {
 public function __construct(
 private float $x,
 private float $y,
 ) {}
}

Visibility#

Modifier	Access
`public`	Anywhere
`protected`	Class + subclasses
`private`	Class only

PHP 8.4 introduces asymmetric visibility:

Error Handling and Exceptions

Mon, 01 Jan 0001 00:00:00 +0000

PHP’s Error Model#

PHP has two parallel error systems — legacy errors and modern exceptions. Understanding both is essential.

The Error Hierarchy (PHP 7+)#

graph TD
 T["Throwable (interface)"] --> Error["Error"]
 T --> Exception["Exception"]
 Error --> TypeError
 Error --> ValueError
 Error --> ArithmeticError
 Error --> DivisionByZeroError
 Error --> ParseError
 Exception --> RuntimeException
 Exception --> LogicException
 Exception --> InvalidArgumentException
 RuntimeException --> OverflowException
 RuntimeException --> UnexpectedValueException
 LogicException --> DomainException
 LogicException --> LengthException

Key distinction:

Error — programming mistakes that should not be caught in normal flow (type errors, parse errors)
Exception — recoverable conditions that business logic should handle

Try / Catch / Finally#

<?php
try {
 $result = riskyOperation();
} catch (SpecificException $e) {
 // Handle specific exception type
 logger()->error('Operation failed', ['error' => $e->getMessage()]);
 $result = fallbackValue();
} catch (AnotherException | YetAnotherException $e) {
 // Catch multiple types (PHP 7.1+)
 handleMultiple($e);
} catch (\Throwable $e) {
 // Last resort — catches both Error and Exception
 logger()->critical('Unexpected error', ['exception' => $e]);
 throw $e; // Re-throw if you can't handle it
} finally {
 // Always runs — cleanup, close resources
 cleanup();
}

Non-Capturing Catches (PHP 8.0+)#

When you don’t need the exception object:

The Type System (PHP 8.x)

Mon, 01 Jan 0001 00:00:00 +0000

Evolution of PHP Types#

PHP started as a loosely-typed scripting language. Modern PHP has a sophisticated gradual type system:

PHP Version	Type Feature Added
5.0	Class/interface type hints (parameters only)
7.0	Scalar types (int, string, float, bool), return types, strict mode
7.1	Nullable (`?Type`), `void`, `iterable`
7.2	`object` type
7.4	Typed properties
8.0	Union types (`int\|string`), `mixed`, `static` return, `null`, `false` as standalone
8.1	Intersection types (`A&B`), `never`, enums, fibers
8.2	DNF types (Disjunctive Normal Form), `null`, `true`, `false` standalone
8.3	Typed class constants
8.4	Property hooks

Strict Types#

By default, PHP coerces values. Enable strict mode per-file:

Namespaces, Autoloading, and Composer

Mon, 01 Jan 0001 00:00:00 +0000

Namespaces#

Namespaces prevent class name collisions and organize code into logical hierarchies:

<?php
// File: src/Payment/Stripe/Client.php
namespace App\Payment\Stripe;

class Client
{
 public function charge(float $amount): Receipt { /* ... */ }
}

<?php
// File: src/Http/Client.php
namespace App\Http;

class Client
{
 public function get(string $url): Response { /* ... */ }
}

Both classes are named Client, but they don’t conflict because they’re in different namespaces.

Using Namespaced Classes#

<?php
namespace App\Service;

// Import with 'use'
use App\Payment\Stripe\Client as StripeClient;
use App\Http\Client as HttpClient;
use App\Entity\{User, Order, Product}; // Group imports

class PaymentService
{
 public function __construct(
 private StripeClient $stripe,
 private HttpClient $http,
 ) {}
}

Convention: PSR-4#

The standard maps namespace to directory structure:

Working with Databases (PDO)

Mon, 01 Jan 0001 00:00:00 +0000

PDO (PHP Data Objects)#

PDO is PHP’s database abstraction layer. It provides a consistent interface for MySQL, PostgreSQL, SQLite, and other databases.

Connecting#

<?php
$dsn = 'mysql:host=localhost;dbname=myapp;charset=utf8mb4';
$pdo = new PDO($dsn, $user, $password, [
 PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, // Throw exceptions on error
 PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC, // Return associative arrays
 PDO::ATTR_EMULATE_PREPARES => false, // Use real prepared statements
]);

Always set these three options. Without ERRMODE_EXCEPTION, errors are silent. Without disabling emulated prepares, you lose type-safe parameter binding.

Prepared Statements (Parameterized Queries)#

Never concatenate user input into SQL. Use prepared statements to prevent SQL injection:

HTTP, Sessions, and the Request Lifecycle

Mon, 01 Jan 0001 00:00:00 +0000

The PHP Request Lifecycle#

PHP is fundamentally request-oriented — each request starts fresh with no shared state:

flowchart LR
 A["Client sends<br/>HTTP request"] --> B["Web server<br/>routes to PHP-FPM"]
 B --> C["PHP boots:<br/>load files, autoloader"]
 C --> D["Application runs:<br/>routing, logic, DB"]
 D --> E["Response generated<br/>and sent"]
 E --> F["Process memory<br/>completely freed"]

Shared-nothing architecture: Every request starts with a clean slate. No state leaks between requests (unlike Node.js or Java servlets). This makes PHP inherently safe from many concurrency bugs, but means you need external storage (sessions, databases, caches) for state.

Testing with PHPUnit

Mon, 01 Jan 0001 00:00:00 +0000

PHPUnit Basics#

PHPUnit is the standard testing framework for PHP.

Setup#

composer require --dev phpunit/phpunit

<!-- phpunit.xml -->
<phpunit bootstrap="vendor/autoload.php" colors="true">
 <testsuites>
 <testsuite name="Unit">
 <directory>tests/</directory>
 </testsuite>
 </testsuites>
 <source>
 <include>
 <directory>src/</directory>
 </include>
 </source>
</phpunit>

Writing Tests#

<?php
// tests/Calculator/CalculatorTest.php
namespace App\Tests\Calculator;

use App\Calculator\Calculator;
use PHPUnit\Framework\TestCase;

class CalculatorTest extends TestCase
{
 private Calculator $calculator;

 protected function setUp(): void
 {
 $this->calculator = new Calculator();
 }

 public function testAddPositiveNumbers(): void
 {
 $result = $this->calculator->add(2, 3);
 $this->assertSame(5, $result);
 }

 public function testDivideByZeroThrowsException(): void
 {
 $this->expectException(\DivisionByZeroError::class);
 $this->calculator->divide(10, 0);
 }

 /**
 * @dataProvider additionProvider
 */
 public function testAddWithDataProvider(int $a, int $b, int $expected): void
 {
 $this->assertSame($expected, $this->calculator->add($a, $b));
 }

 public static function additionProvider(): array
 {
 return [
 'positive numbers' => [1, 2, 3],
 'negative numbers' => [-1, -2, -3],
 'zero' => [0, 0, 0],
 'mixed signs' => [-5, 3, -2],
 ];
 }
}

Running Tests#

vendor/bin/phpunit # All tests
vendor/bin/phpunit tests/Calculator/ # Specific directory
vendor/bin/phpunit --filter=testAdd # Specific test method
vendor/bin/phpunit --coverage-html=coverage/ # With code coverage report

Assertions#

Assertion	Purpose
`assertSame($expected, $actual)`	Strict equality (===)
`assertEquals($expected, $actual)`	Loose equality (==)
`assertTrue($value)`	Assert truthy
`assertFalse($value)`	Assert falsy
`assertNull($value)`	Assert null
`assertCount($n, $array)`	Array/Countable has exactly N items
`assertContains($needle, $haystack)`	Array contains value
`assertArrayHasKey($key, $arr)`	Array has specific key
`assertInstanceOf(Class::class, $obj)`	Object is instance of class
`assertStringContainsString($sub, $str)`	String contains substring
`assertMatchesRegularExpression($re, $str)`	Regex match

Prefer assertSame over assertEquals — strict comparison catches type bugs.

Modern PHP Patterns and Architecture

Mon, 01 Jan 0001 00:00:00 +0000

Dependency Injection#

The most important pattern in modern PHP. Instead of creating dependencies internally, inject them from outside:

<?php
// ❌ Tight coupling — hard to test, can't swap implementations
class OrderService
{
 public function process(Order $order): void
 {
 $mailer = new SmtpMailer(); // hardcoded dependency
 $mailer->send($order->getEmail(), 'Order confirmed');
 }
}

// ✅ Dependency injection — testable, flexible
class OrderService
{
 public function __construct(
 private readonly MailerInterface $mailer,
 private readonly OrderRepository $repository,
 ) {}

 public function process(Order $order): void
 {
 $this->repository->save($order);
 $this->mailer->send($order->getEmail(), 'Order confirmed');
 }
}

DI Containers#

A container autowires dependencies based on type declarations:

Frameworks: Laravel and Symfony

Mon, 01 Jan 0001 00:00:00 +0000

The Two Major Frameworks#

Modern PHP development almost always uses a framework. The two dominant choices:

Aspect	Laravel	Symfony
Philosophy	Convention over configuration, DX-first	Explicit configuration, flexibility
Learning curve	Gentle — lots of “magic” helpers	Steeper — more boilerplate, more control
Best for	Rapid application development, startups, APIs	Enterprise apps, complex domains, microservices
ORM	Eloquent (Active Record)	Doctrine (Data Mapper)
Template engine	Blade	Twig
CLI	Artisan	Console component
DI Container	Built-in (service container)	Full autowiring container
Ecosystem	Laravel Forge, Vapor, Nova, Horizon	Bundles, Flex, recipes

Laravel Overview#

Request Lifecycle#

flowchart LR
 A["HTTP Request"] --> B["public/index.php"]
 B --> C["Service Container<br/>Boot"]
 C --> D["Middleware<br/>Pipeline"]
 D --> E["Router →<br/>Controller"]
 E --> F["Controller<br/>Logic"]
 F --> G["Response"]
 G --> D
 D --> H["HTTP Response"]

Routing#

<?php
// routes/web.php
Route::get('/users', [UserController::class, 'index']);
Route::post('/users', [UserController::class, 'store']);
Route::get('/users/{user}', [UserController::class, 'show']); // Route model binding

// API resource routes (generates index, store, show, update, destroy)
Route::apiResource('products', ProductController::class);

Controllers#

<?php
class UserController extends Controller
{
 public function index(): JsonResponse
 {
 $users = User::paginate(20);
 return response()->json($users);
 }

 public function store(CreateUserRequest $request): JsonResponse
 {
 $user = User::create($request->validated());
 return response()->json($user, 201);
 }

 // Route model binding — Laravel auto-fetches User by ID
 public function show(User $user): JsonResponse
 {
 return response()->json($user->load('orders'));
 }
}

Eloquent ORM (Active Record)#

<?php
class User extends Model
{
 protected $fillable = ['name', 'email', 'password'];
 protected $hidden = ['password'];
 
 // Relationships
 public function orders(): HasMany
 {
 return $this->hasMany(Order::class);
 }

 public function roles(): BelongsToMany
 {
 return $this->belongsToMany(Role::class);
 }
}

// Usage
$users = User::where('active', true)
 ->orderBy('name')
 ->with('orders') // Eager load to prevent N+1
 ->paginate(20);

Symfony Overview#

Architecture#

Symfony is a collection of decoupled components. You can use individual components (like HttpFoundation, Console, Mailer) without the full framework.

Performance, OpCache, and Deployment

Mon, 01 Jan 0001 00:00:00 +0000

OPcache#

OPcache stores compiled PHP opcodes in shared memory, eliminating re-parsing/compiling on each request:

; php.ini — production OPcache settings
opcache.enable=1
opcache.memory_consumption=256
opcache.interned_strings_buffer=16
opcache.max_accelerated_files=20000
opcache.validate_timestamps=0 ; Don't check file modification times in production
opcache.save_comments=1 ; Required for annotations/attributes
opcache.jit_buffer_size=100M ; JIT compilation (PHP 8.0+)
opcache.jit=1255 ; Enable JIT (tracing mode)

Critical setting: opcache.validate_timestamps=0 in production means PHP never checks if files changed on disk — you must restart PHP-FPM after deployment.

Security

Mon, 01 Jan 0001 00:00:00 +0000

Security#

PHP powers 75% of the web — making it the most targeted server-side language. This section covers the security vulnerabilities that affect PHP applications and the practices that prevent them.

SQL Injection#

The most critical web vulnerability. User input is interpolated into SQL, allowing attackers to execute arbitrary queries.

// VULNERABLE — never do this
$query = "SELECT * FROM users WHERE email = '$email'";
// Input: ' OR 1=1; DROP TABLE users; --

// SAFE — parameterised queries (PDO)
$stmt = $pdo->prepare("SELECT * FROM users WHERE email = :email");
$stmt->execute(['email' => $email]);
$user = $stmt->fetch();

// SAFE — prepared statements (MySQLi)
$stmt = $mysqli->prepare("SELECT * FROM users WHERE email = ?");
$stmt->bind_param("s", $email);
$stmt->execute();

Rule: Never concatenate user input into SQL. Always use prepared statements.