Question 1

What is PHP and how does its shared-nothing request lifecycle work?

Accepted Answer

PHP (Hypertext Preprocessor) is a widely-used open-source general-purpose scripting language especially suited for web development and backend server APIs.

### The Shared-Nothing Architecture:
Unlike Node.js or Java (where a single long-running server process stays alive in memory and shares variables across millions of incoming HTTP requests), PHP operates on a **Shared-Nothing Request Lifecycle**:
1. **Initialization**: When an HTTP request arrives at the web server (NGINX/Apache), PHP-FPM (FastCGI Process Manager) assigns a dedicated PHP worker process to handle that single request.
2. **Execution**: PHP loads the script, compiles it to opcode (if not cached), connects to the database, executes the logic, and generates the HTML or JSON HTTP response payload.
3. **Complete Teardown**: The moment the response is sent to the client, PHP **completely destroys all variables, objects, database connections, and memory allocations created during the request**. The worker process resets to a clean slate for the next request.

### Why This Matters:
Because nothing is shared between requests, memory leaks in PHP scripts cannot crash the entire server over time! However, it also means you cannot store state (like user login sessions or WebSocket connections) in global PHP variables; you must use external storage like Redis, Memcached, or databases.

Key Takeaway: PHP destroys all memory and variables at the end of every HTTP request. Use external storage (Redis/Sessions) for persistent state.

Question 2

What is the difference between echo and print in PHP?

Accepted Answer

Both 'echo' and 'print' are language constructs used to output strings to the browser, but they have minor behavioral differences:

### 1. 'echo':
- Has **no return value** (returns 'void').
- Can accept **multiple parameters** separated by commas: 'echo "Hello ", "World", "!";'.
- Slightly faster than 'print' because it does not return a value.

### 2. 'print':
- Behaves like a function and **always returns the integer '1'**.
- Can **only accept a single argument**: 'print "Hello World";'.
- Can be used in complex expressions (e.g., inside ternary operators: '$isLoggedIn ? print "Welcome" : print "Login";').

### Best Practice:
Use **'echo'** as your default choice for outputting content in PHP. It is cleaner, supports multiple arguments without concatenation overhead, and executes slightly faster.

Key Takeaway: Use echo by default because it is slightly faster and accepts multiple comma-separated arguments without concatenation.

Question 3

What is the difference between isset(), empty(), and is_null() in PHP?

Accepted Answer

In PHP, inspecting variable existence and truthiness requires understanding how these three functions handle 'null', undefined variables, and "empty" values:

### 1. 'isset($var)':
- Returns 'true' if the variable **exists AND is not 'null'**.
- Crucially, calling 'isset()' on an **undefined variable does NOT trigger an Undefined Variable Warning**! This makes it ideal for checking array keys ('isset($_GET["id"])').

### 2. 'empty($var)':
- Returns 'true' if the variable is **undefined, 'null', OR evaluates to a Falsy value** (such as '""' empty string, '0', '0.0', '"0"' string zero, 'false', or '[]' empty array).
- *Trap*: If a user submits a form input with the value '"0"' (like rating 0 stars), 'empty($_POST["rating"])' returns 'true'!

### 3. 'is_null($var)':
- Returns 'true' **only if the variable is explicitly 'null'**.
- If called on an undefined variable, it throws a PHP Warning / Notice!

Key Takeaway: Use isset() to safely check if variables/array keys exist without warnings. Be careful with empty() on "0" and integer 0.

Question 4

What is the difference between Indexed, Associative, and Multidimensional Arrays in PHP?

Accepted Answer

Unlike languages like C or Java that have separate data structures for indexed arrays, linked lists, and dictionaries/hash maps, **PHP has only one underlying array type**: an **Ordered Hash Table**.

### 1. Indexed Arrays:
- Arrays where keys are sequential numeric integers starting at '0'.
- Syntax: '$fruits = ["Apple", "Banana", "Cherry"];'

### 2. Associative Arrays:
- Arrays where keys are named strings (acting like dictionaries or hash maps in Python/JS).
- Syntax: '$user = ["name" => "Alice", "role" => "admin", "age" => 28];'

### 3. Multidimensional Arrays:
- Arrays containing nested arrays as values, used to represent grids or tabular database query results.
- Syntax: '$users = [ ["id" => 1, "name" => "Alice"], ["id" => 2, "name" => "Bob"] ];'

Because PHP arrays are ordered hash maps, they preserve the exact insertion order of elements when looped over with 'foreach', regardless of whether keys are integers or strings!

Key Takeaway: PHP arrays are ordered hash tables supporting both sequential integer keys (indexed) and named string keys (associative).

Question 5

What does declare(strict_types=1); do in PHP 7+ and why should you use it?

Accepted Answer

Historically, PHP was a weakly-typed language that performed aggressive automatic type coercion. For example, if a function expected an integer 'function add(int $a, int $b)', calling 'add("10", "20")' would silently coerce the strings into integers and return '30'.

### What 'declare(strict_types=1);' Does:
When you place 'declare(strict_types=1);' as the very first statement at the top of a PHP file, PHP disables automatic type coercion for all function calls made *inside that file*.
- If a function expects an 'int', passing a string '"10"' or float '10.5' will immediately throw a **'TypeError' fatal exception** at runtime!
- Ensures function arguments and return types match their declared scalar type hints ('int', 'float', 'string', 'bool', 'array', 'object') exactly.

### Best Practice (2026):
Always enable 'declare(strict_types=1);' at the top of every class and script in modern PHP engineering to catch type mismatch bugs immediately during development.

Key Takeaway: Always put declare(strict_types=1); at the top of PHP files to disable silent type coercion and enforce strict scalar type hints.

Question 6

What is the difference between single quotes ('') and double quotes ("") in PHP strings?

Accepted Answer

PHP treats single-quoted and double-quoted strings differently during parsing:

### 1. Double Quotes (""):
- **Variable Interpolation**: Automatically evaluates variables embedded inside the string (e.g. '"Hello $name"').
- **Escape Sequences**: Parses escape sequences like '
' (newline), '	' (tab), and ''.
- **Curly Brace Syntax**: Supports complex array or property evaluation: '"User: {$user["name"]}"'.

### 2. Single Quotes (''):
- **Literal Strings**: Treats string contents literally. Variables like '$name' are **NOT evaluated** (echoes literal '$name').
- **Escape Sequences**: Does not parse '
' or '	' (echoes literal '
'). The only valid escape sequences are '\' (backslash) and ''' (single quote).
- **Performance**: Marginally faster because PHP skips regex variable parsing.

Key Takeaway: Use double quotes for string interpolation and escape sequences; use single quotes for static string literals.

Question 7

What is the difference between array_merge($a, $b) and the array union operator ($a + $b)?

Accepted Answer

Merging two associative or indexed arrays in PHP can be done using 'array_merge()' or the '+' union operator, but their duplicate key resolution logic is opposite:

### 1. 'array_merge($a, $b)':
- **Associative String Keys**: If '$a' and '$b' share the same string key, **the value from '$b' overwrites '$a'**.
- **Numeric Keys**: Numeric keys are **re-indexed sequentially starting from 0**, appending values from '$b' to '$a'.

### 2. Array Union Operator ('$a + $b'):
- **Associative String Keys**: If '$a' and '$b' share the same string key, **the value from '$a' is PRESERVED**, and '$b' is ignored!
- **Numeric Keys**: Numeric keys are **NOT re-indexed**. If key '0' exists in '$a', key '0' from '$b' is discarded.

Key Takeaway: array_merge() overwrites string keys with the second array and re-indexes numeric keys; + preserves the first array's keys.

Question 8

Why is modifying array elements by reference inside foreach ($items as &$item) dangerous and how do you fix it?

Accepted Answer

In PHP, iterating over an array by reference ('foreach ($items as &$item)') allows mutating array elements directly without array indexing. However, it creates a infamous memory reference trap if not cleaned up.

### The Reference Bug Trap:
When the loop finishes, the variable **'$item' remains an active reference bound to the last element of the array in memory**.

If you later execute another standard 'foreach ($items as $item)' loop using the same variable name '$item', PHP will overwrite the last element of your array on every iteration of the second loop, corrupting your data!

### The Solution:
Always call **'unset($item);'** immediately after finishing a reference 'foreach' loop to destroy the reference binding pointer.

Key Takeaway: Always call unset($item) immediately after a reference foreach ($arr as &$item) loop to prevent array data corruption in subsequent loops.

Question 9

How does the Null Coalescing Operator (??) differ from the Ternary Operator (?:) and Null Coalescing Assignment (??=)?

Accepted Answer

PHP provides multiple short-hand operators for assigning default values:

### 1. Null Coalescing Operator ('$a ?? $default'):
- Returns '$a' if it **exists AND is not 'null'**; otherwise returns '$default'.
- **Notice Suppression**: Does NOT trigger an "Undefined index" notice if '$a' is an undefined array key or variable.

### 2. Short Ternary Operator ('$a ?: $default'):
- Returns '$a' if it evaluates to **Truthy**; otherwise returns '$default'.
- *Trap*: Triggers an Undefined Variable notice if '$a' is not set! Treats '0', '""', and 'false' as empty.

### 3. Null Coalescing Assignment ('$a ??= $default') (PHP 7.4+):
- Assigns '$default' to '$a' **only if '$a' is currently null or undefined**. Equivalent to '$a = $a ?? $default'.

Key Takeaway: Use ?? to assign defaults for potentially missing keys without notices; use ?: for truthiness checks; use ??= to set defaults in-place.

Question 10

What is the difference between include, require, include_once, and require_once?

Accepted Answer

PHP provides four statements for importing external code files:

### 1. Error Severity:
- **'require'**: Used for mandatory application files (database configs, core classes). If the file is missing, PHP throws a **Fatal Error ('E_COMPILE_ERROR')** and immediately halts execution.
- **'include'**: Used for non-essential template files (sidebar, footer). If the file is missing, PHP emits a **Warning ('E_WARNING')** and continues executing the script.

### 2. The '_once' Suffix:
- **'require_once'** and **'include_once'**: Check if the file was already imported previously during the current request. If so, PHP skips loading it again, preventing "Cannot redeclare function/class" fatal errors!

Key Takeaway: require halts script execution on missing files with a Fatal Error; include emits a warning; _once prevents duplicate loading.

Question 11

How does the Combined Comparison Spaceship Operator (<=>) work in PHP 7+ sorting callbacks?

Accepted Answer

The **Spaceship Operator ('<=>')** (introduced in PHP 7) performs three-way comparison between two expressions '$a <=> $b': ### Return Values: - **'-1'**: If '$a' is less than '$b' ('$a < $b'). - **'0'**: If '$a' is equal to '$b' ('$a == $b'). - **'1'**: If '$a' is greater than '$b' ('$a > $b'). ### Best Use Case: 'usort()' Callbacks Before PHP 7, custom array sorting required verbose 'if/else' blocks returning '-1', '0', or '1'. The spaceship operator condenses comparison callbacks into a single line of code! Key Takeaway: $a <=> $b returns -1, 0, or 1, simplifying custom array sorting in usort() callbacks.

Question 12

What are PHP Superglobal arrays ($_GET, $_POST, $_SERVER, $_SESSION, $_COOKIE) and how do they work?

Accepted Answer

**Superglobals** are built-in associative arrays in PHP that are automatically accessible from anywhere in a script (inside functions, methods, or global scope) without needing the 'global' keyword.

### Common Superglobals:
- **'$_GET'**: Contains HTTP GET URL query parameters ('/page.php?id=42').
- **'$_POST'**: Contains HTTP POST form submission body data.
- **'$_SERVER'**: Contains web server headers, request paths, client IP addresses, and script metadata.
- **'$_SESSION'**: Stores persistent session data across HTTP requests for a user.
- **'$_COOKIE'**: Contains HTTP cookies sent by the client browser.
- **'$_FILES'**: Contains uploaded file metadata and temporary storage paths.

Key Takeaway: Superglobals ($_GET, $_POST, $_SERVER, $_SESSION) are built-in arrays accessible everywhere in PHP without global keywords.

Question 13

How do you configure error_reporting() and display_errors in development versus production environments?

Accepted Answer

Managing error reporting settings correctly is essential for developer productivity and production security.

### 1. Local Development Settings:
Show all errors, warnings, and notices on screen immediately to catch bugs:
- 'error_reporting(E_ALL);'
- 'ini_set("display_errors", "1");'

### 2. Production Environment Settings:
**NEVER display raw PHP errors to users in production!** Exposing file paths, database queries, and stack traces provides attackers with exploitation insights.
- 'ini_set("display_errors", "0");'
- 'ini_set("log_errors", "1");'
- 'ini_set("error_log", "/var/log/php/error.log");'

Key Takeaway: In development, display all errors on screen; in production, hide display_errors and log errors to disk securely.

Question 14

How do function arguments pass by value versus pass by reference (&$param) in PHP?

Accepted Answer

PHP functions support two ways of receiving parameter arguments:

### 1. Pass-by-Value (Default):
- When a variable is passed to a function, PHP passes a copy of the value (optimized internally via Copy-on-Write).
- Modifying the parameter inside the function **does NOT alter the original variable** outside the function.

### 2. Pass-by-Reference ('&$param'):
- Prefixing a parameter with an ampersand ('&$param') passes the memory address reference of the original variable.
- Any modification inside the function **directly mutates the original variable** in the calling scope!

Key Takeaway: Function parameters pass by value by default. Use ampersand (&$param) to pass by reference and mutate original variables.

Question 15

Why do PHP objects appear to pass by reference by default, and how does object cloning (clone $obj) work?

Accepted Answer

In PHP 5+, object variables do not store the actual object data directly; they store an **Object Identifier handle** pointing to the memory location of the object instance.

### Passing Objects to Functions:
When you pass an object variable to a function, PHP passes a copy of the handle. Because both handles point to the exact same underlying object, modifying object properties inside the function mutates the original object!

### Cloning Objects ('clone $obj'):
To create a true, independent copy of an object, use the **'clone'** keyword. You can customize cloning logic using the **'__clone()'** magic method to perform deep copies of nested objects.

Key Takeaway: Object variables hold handle pointers to instances. Use the clone keyword to create an independent copy of an object instance.

Question 16

How do PHP 7.4+ short Arrow Functions (fn() => ...) differ from standard anonymous closures?

Accepted Answer

PHP 7.4 introduced short **Arrow Functions** ('fn() => expression') as a concise syntax for anonymous closures.

### Key Differences:
1. **Implicit Scope Binding**:
   - Traditional Closure: Requires explicitly importing outer scope variables using the 'use ($var)' syntax ('function() use ($multiplier)').
   - Arrow Function: **Automatically captures outer scope variables by value** implicitly without needing 'use ()'!
2. **Single Expression Limit**:
   - Arrow functions can contain only a **single expression**, which is automatically evaluated and returned.
   - Traditional closures can contain multi-line code blocks and explicit 'return' statements.

Key Takeaway: Arrow functions (fn($x) => $x * $y) automatically capture outer scope variables by value and return single expressions.

Question 17

What is the difference between defining constants using define("FOO", 1) versus the const keyword?

Accepted Answer

PHP provides two ways to declare constants:

### 1. 'const' Keyword:
- **Compile-Time**: Evaluated at compile time.
- **Scope**: Can be used inside classes ('public const TAX_RATE = 0.20;') and interfaces.
- **Constraint**: Cannot be declared inside conditional blocks like 'if ()' or functions.

### 2. 'define()' Function:
- **Run-Time**: Evaluated at runtime when the function executes.
- **Scope**: Always global. Cannot be used inside class definitions.
- **Flexibility**: Can be called conditionally inside 'if' blocks or using dynamic string names ('define("APP_" . $env, 1)').

Key Takeaway: Use const for class constants and compile-time constants; use define() for conditional runtime definitions.

Question 18

How do explicit type casting and scalar conversion work in PHP?

Accepted Answer

PHP allows converting values explicitly between data types using cast operators:

### Cast Operators:
- **'(int)', '(integer)'**: Casts to integer. Floating points are truncated towards zero. Numeric strings ('"42.5"') become '42'. Non-numeric strings ('"abc"') become '0'.
- **'(bool)', '(boolean)'**: Casts to boolean. '0', '0.0', '""', '"0"', 'null', and '[]' cast to 'false'; everything else casts to 'true'.
- **'(string)'**: Casts to string. 'true' becomes '"1"', 'false' becomes '""'.
- **'(array)'**: Converts scalar values into a 1-element array, or objects into an associative array of properties.
- **'(object)'**: Converts associative arrays into 'stdClass' objects.

Key Takeaway: Use explicit type casts ((int), (bool), (array), (object)) to reliably convert data types in PHP.

Question 19

Why must you use mb_strlen() and mb_substr() instead of strlen() and substr() for UTF-8 multibyte strings?

Accepted Answer

Standard PHP string functions ('strlen()', 'substr()', 'strpos()') are designed for single-byte ASCII encodings where 1 character = 1 byte.

### The Multibyte Problem:
Unicode UTF-8 characters (accented characters 'é', non-Latin alphabets, and emojis '😊') take between **2 to 4 bytes per character** in memory!
- Standard 'strlen("hello 😊")' counts raw bytes, returning '10' instead of 7 characters!
- Standard 'substr()' will chop multibyte UTF-8 characters in half, resulting in corrupted, invalid character output.

### Solution:
Always use the **'mb_*' (Multibyte String)** extension functions ('mb_strlen()', 'mb_substr()', 'mb_strpos()') for user-facing UTF-8 text processing.

Key Takeaway: Use mb_* functions (mb_strlen, mb_substr) to accurately process UTF-8 multibyte text and emojis without string corruption.

Question 20

How do json_encode() and json_decode() work and why is the second parameter in json_decode($json, true) critical?

Accepted Answer

'json_encode()' and 'json_decode()' convert between PHP data structures and JSON strings:

### 'json_decode($json, $associative)':
- Default ('json_decode($json)'): Decodes JSON objects into PHP **'stdClass' objects** ('$data->key').
- Associative Mode (**'json_decode($json, true)'**): Passing 'true' decodes JSON objects into standard **PHP Associative Arrays** ('$data["key"]').

### Best Practice - Error Handling (PHP 7.3+):
Pass the **'JSON_THROW_ON_ERROR'** flag to throw a catchable 'JsonException' when decoding invalid JSON payloads instead of failing silently!

Key Takeaway: Pass true as the 2nd argument to json_decode() to decode JSON objects into PHP associative arrays.

Question 21

How do PHP sessions work internally via PHPSESSID cookies and why must you call session_regenerate_id(true) on login?

Accepted Answer

PHP sessions track user state across HTTP requests:

### How Sessions Work Internally:
1. When 'session_start()' is called, PHP checks for a 'PHPSESSID' cookie sent by the browser.
2. If absent, PHP generates a random Session ID, sets the 'PHPSESSID' cookie, and creates a matching session file on the server disk (or Redis).
3. Data stored in the '$_SESSION' superglobal is serialized and saved to that server-side session file.

### Preventing Session Fixation Attacks:
In a **Session Fixation** attack, a hacker tricks a victim into using a known Session ID *before* logging in. If the application keeps the same Session ID after authentication, the hacker gains access!
- **Mitigation**: Always call **'session_regenerate_id(true)'** immediately after a user successfully logs in to issue a brand new Session ID and delete the old session file!

Key Takeaway: Call session_regenerate_id(true) immediately upon user authentication to issue a new session ID and defeat Session Fixation.

Question 22

How do you set secure, tamper-resistant HTTP cookies in PHP using setcookie() with SameSite and HttpOnly flags?

Accepted Answer

'setcookie()' sends HTTP 'Set-Cookie' response headers to store client-side cookies in the browser.

### Essential Security Options Array (PHP 7.3+):
- **'expires'**: Expiration Unix timestamp.
- **'secure' => true**: Restricts cookie transmission strictly to encrypted **HTTPS** connections.
- **'httponly' => true**: Prevents client-side JavaScript ('document.cookie') from accessing the cookie, defeating **XSS token theft**!
- **'samesite' => 'Strict' / 'Lax'**: Restricts sending cookies on cross-site requests, mitigating **CSRF attacks**.

Key Takeaway: Set httponly => true and samesite => Strict on cookies to mitigate XSS script theft and CSRF cross-site attacks.

Question 23

Why does calling header("Location: ...") throw "Headers already sent" and how does Output Buffering (ob_start) fix it?

Accepted Answer

In the HTTP protocol, **response headers MUST be sent before the response body content**.

### Why "Headers Already Sent" Occurs:
If your script echoes even a single space character, HTML tag, or UTF-8 BOM before calling 'header()', PHP automatically flushes HTTP headers and starts sending body content. Calling 'header("Location: ...")' afterwards throws a fatal error!

### Solution - Output Buffering ('ob_start()'):
Output Buffering holds all echoed body content in server RAM instead of sending it directly to the browser. This allows calling 'header()' anywhere in your code. The buffer is flushed to the browser at script completion.

Key Takeaway: HTTP response headers must precede body content. Use ob_start() Output Buffering to buffer content in RAM and prevent header errors.

Question 24

Why should you always use the __DIR__ magic constant when including relative files in PHP?

Accepted Answer

Using relative paths like 'require "config.php";' or 'require "../bootstrap.php";' relies on the **Current Working Directory (CWD)** of the master executing script (e.g. 'public/index.php').

### The Problem:
If a nested script or CLI command is executed from a different working directory, relative path includes fail with "Failed opening required file" errors!

### The Solution - '__DIR__':
The **'__DIR__'** magic constant always evaluates to the **absolute filesystem directory of the file in which it is written**. Combining '__DIR__' with relative paths ensures file imports resolve consistently regardless of where the script was invoked.

Key Takeaway: Always prefix file inclusions with __DIR__ to guarantee absolute path resolution independent of the current working directory.

Question 25

What is the difference between var_dump(), print_r(), and var_export() for variable debugging?

Accepted Answer

PHP provides three primary functions for inspecting variable structures during debugging:

### 1. 'var_dump($var)':
- Outputs detailed structural info including **data types** ('string(5)', 'int(42)') and array/string lengths.
- Does not return a string value directly (outputs to buffer).

### 2. 'print_r($var, $return)':
- Prints a clean, human-readable structural representation **without explicit data types**.
- Passing 'true' as 2nd parameter returns the output as a string instead of echoing it.

### 3. 'var_export($var, $return)':
- Outputs a representation formatted as **valid, executable PHP code syntax**! Ideal for generating static configuration code files.

Key Takeaway: var_dump shows data types and lengths; print_r gives human-readable structure; var_export outputs valid executable PHP code syntax.

Question 26

Why should you always use DateTimeImmutable over DateTime for date and time calculations in PHP?

Accepted Answer

PHP provides two primary class representations for dates and times:

### 1. 'DateTime' (Mutable - Dangerous):
- Calling modification methods like '$date->modify("+1 day")' or '$date->setTimezone()' **mutates the original object instance in place**.
- If a 'DateTime' object is passed to a function or stored in a class property, external modifications accidentally mutate date values throughout the application!

### 2. 'DateTimeImmutable' (Immutable - Safe):
- Calling modification methods does NOT alter the original instance; it **returns a brand new cloned 'DateTimeImmutable' instance** with the updated timestamp.
- Eliminates date mutation side effects across domain logic.

Key Takeaway: Always use DateTimeImmutable for date calculations to prevent unexpected date mutation side effects across function calls.

Question 27

How do functional array manipulation methods (array_map, array_filter, array_reduce) work in PHP?

Accepted Answer

PHP provides higher-order functional utilities for array transformations:

### 1. 'array_map($callback, $array)':
- Applies callback to every element, returning a new array of transformed values.
- *Parameter Order*: Callback comes **FIRST**, array comes **SECOND**.

### 2. 'array_filter($array, $callback)':
- Returns a new array containing only elements where callback returns 'true'.
- *Key Preservation*: **Preserves original array keys**! Use 'array_values()' afterwards if you need re-indexed 0-based keys.
- *Parameter Order*: Array comes **FIRST**, callback comes **SECOND**.

### 3. 'array_reduce($array, $callback, $initial)':
- Iteratively reduces an array to a single aggregated value (sum, string concatenation).

Key Takeaway: array_map transforms elements; array_filter filters elements while preserving keys; array_reduce aggregates an array into a single value.

Question 28

Why should you catch Throwable instead of Exception in PHP 7+ global error handlers?

Accepted Answer

Since PHP 7, the error and exception hierarchy was completely redesigned:

### The 'Throwable' Hierarchy:
- Both **'Exception'** (userland application exceptions) and **'Error'** (fatal runtime engine errors like 'TypeError', 'ParseError', 'DivisionByZeroError') implement the root **'Throwable'** interface.
- Catching 'catch (Exception $e)' will **NOT catch fatal engine errors**!
- To build a global error handler that traps both application exceptions and fatal PHP runtime errors, catch **'Throwable'**.

### The 'finally' Block:
The 'finally' block executes unconditionally after 'try' and 'catch' blocks, ensuring cleanup operations (closing file handles, releasing locks) run even if exceptions occur.

Key Takeaway: Catch Throwable to trap both userland Exception instances and PHP engine Error exceptions in global error handlers.

Question 29

How do PHP namespaces prevent class naming collisions and how does the use keyword alias imports?

Accepted Answer

Namespaces organize code into logical directory-like structures to prevent class naming collisions between different libraries.

### Core Namespace Rules:
1. **Declaration**: Declared at the very top of a file using 'namespace AppServices;'.
2. **Fully Qualified Class Name (FQCN)**: Absolute path to a class, starting with a backslash ('AppServicesPaymentService').
3. **The 'use' Statement**: Imports a class into the current file scope so you can reference it by short name.
4. **Aliasing ('as')**: Rename imported classes to avoid collisions when two packages share a class name ('use StripeCharge as StripeCharge;').

Key Takeaway: Namespaces isolate code libraries to prevent naming collisions. Use the use keyword with aliases (as) to manage class imports cleanly.

Question 30

How do you inspect PHP environment extensions, memory limits, and configuration settings using phpinfo() and ini_get()?

Accepted Answer

Inspecting runtime environment configurations ensures scripts have necessary memory and PHP binary extensions available:

### Environment Inspection Utilities:
- **'ini_get("setting")'**: Reads active 'php.ini' configuration values (e.g. 'ini_get("memory_limit")').
- **'extension_loaded("ext")'**: Checks if a binary extension is installed and active (e.g. 'extension_loaded("pdo_mysql")').
- **'phpversion()'**: Returns current running PHP version string (e.g. '"8.3.4"').
- **'phpinfo()'**: Outputs a complete HTML page detailing PHP build configurations, loaded modules, and environment variables.

### Security Warning:
**NEVER expose 'phpinfo()' on public production URLs!** Hackers use 'phpinfo()' outputs to discover exact OS versions, loaded modules, and internal file paths for targeted exploits.

Key Takeaway: Use ini_get() and extension_loaded() to verify runtime requirements. Never expose phpinfo() on public production servers.

Question 31

What are PHP Traits and how do they solve single inheritance limitations?

Accepted Answer

Like Java, PHP enforces **Single Inheritance**: a class can only extend one parent class ('class Dog extends Animal'). However, in complex domains, you often need to share methods (like logging or UUID generation) across unrelated class hierarchies without duplicating code.

### How Traits Work:
A **Trait** ('trait Loggable') enables horizontal code reuse. You inject traits into any class using the **'use'** keyword inside the class body.

### Resolving Method Collisions:
If two traits included in the same class define a method with the exact same name, PHP throws a fatal compile error! Resolve collisions using **'insteadof'** (to choose which trait method to use) and **'as'** (to alias conflicting methods).

Key Takeaway: Traits enable horizontal code reuse across unrelated classes in PHP. Resolve method collisions using insteadof and as keywords.

Question 32

How does PDO (PHP Data Objects) prevent SQL Injection using Prepared Statements?

Accepted Answer

**PDO (PHP Data Objects)** is a lightweight interface for accessing databases in PHP, supporting 12+ database drivers with a unified API.

### How Prepared Statements Defeat SQLi:
When using PDO Prepared Statements ('$stmt = $pdo->prepare("SELECT * FROM users WHERE email = :email")'), execution happens in two distinct steps:
1. **Prepare**: PHP sends the SQL template with placeholders (':email') to the database. The database compiles the query structure **before** seeing any user data.
2. **Execute**: User parameters are sent separately as literal data strings. Because the SQL structure is already compiled, user input **cannot alter query logic or execute injected SQL commands**.

Key Takeaway: Always use PDO prepared statements with parameter binding (:placeholder) and set ATTR_EMULATE_PREPARES to false to eliminate SQL injection.

Question 33

How does Composer PSR-4 Autoloading work with PHP Namespaces?

Accepted Answer

**PSR-4** is the industry-standard autoloading specification managed by **Composer**, mapping PHP Namespaces directly to directory structures.

### How PSR-4 Works:
In your 'composer.json' file, map a base namespace prefix to a directory:
```json
"autoload": {
    "psr-4": { "App\": "src/" }
}
```
When you instantiate 'new AppControllersUserController()', Composer's autoloader intercepts the request, maps 'App' to 'src/', appends 'Controllers/UserController.php', and executes 'require' lazily on demand!

Key Takeaway: Map namespaces to directories in composer.json under psr-4. Require vendor/autoload.php once to load classes lazily.

Question 34

How do PHP Generators (yield keyword) process massive datasets without exhausting memory_limit?

Accepted Answer

Standard functions return a single value and terminate. A **Generator** function uses the **'yield'** keyword to produce a sequence of values lazily over time.

### Memory Optimization Advantage:
If you read a 2GB CSV file into a standard array, PHP attempts to allocate 2GB of RAM, throwing a Fatal "Allowed memory size exhausted" error.

With a Generator, PHP yields **one item at a time into memory during iteration**, keeping total RAM usage under 2MB regardless of dataset size!

Key Takeaway: Generators yield items lazily one at a time during iteration, allowing processing of massive datasets under 2MB RAM.

Question 35

How do PHP 7+ Anonymous Classes work and why are they useful in unit testing?

Accepted Answer

PHP 7 introduced **Anonymous Classes** ('new class implements Interface {}'), allowing on-the-fly instantiation of unnamed objects.

### Use Cases:
1. **Lightweight Unit Test Mocks**: Quickly implement interface stubs in tests without creating dedicated '.php' class files.
2. **One-Off Event Handlers**: Pass single-use callback implementations to framework event dispatchers.

Key Takeaway: Anonymous classes (new class implements Interface) create inline, one-off objects ideal for lightweight testing mocks.

Question 36

What is the SPL (Standard PHP Library) and when should you use SplFixedArray, SplQueue, or SplHeap?

Accepted Answer

The **SPL (Standard PHP Library)** provides optimized data structures and iterator interfaces built directly into the PHP C core.

### Key SPL Data Structures:
- **'SplFixedArray'**: Fixed-length array with non-negative integer keys. Consumes **30-40% less RAM** than standard PHP hash table arrays!
- **'SplQueue'**: FIFO queue providing $O(1)$ push/pop operations without array re-indexing overhead ('array_shift()').
- **'SplMinHeap' / 'SplMaxHeap'**: Binary heap providing $O(log N)$ priority queue sorting.

Key Takeaway: SPL data structures (SplFixedArray, SplQueue) offer optimized memory and $O(1)$ performance compared to general PHP arrays.

Question 37

How do PHP dunder magic methods (__get, __set, __call, __toString, __invoke) power dynamic object overloading?

Accepted Answer

PHP **Magic Methods** (prefixed with '__') intercept dynamic operations on objects:

### Key Magic Methods:
- **'__get($prop)' / '__set($prop, $val)'**: Intercept access to inaccessible or undefined properties (powers ORM dynamic model attributes like '$user->email').
- **'__call($method, $args)'**: Intercepts calls to undefined instance methods (powers dynamic query builders like 'User::findByName()').
- **'__toString()'**: Controls string representation when an object is echoed ('echo $user').
- **'__invoke()'**: Allows an object instance to be called directly like a function ('$object()').

Key Takeaway: Magic methods (__get, __set, __call, __invoke) intercept dynamic property and method calls, powering ORMs and flexible APIs.

Question 38

How do serialize() and unserialize() work with __serialize() and __unserialize() in PHP 7.4+?

Accepted Answer

'serialize()' converts PHP data structures and objects into a storable byte-stream string; 'unserialize()' reconstitutes the original object state.

### Modern Custom Serialization (PHP 7.4+):
- **'__serialize(): array'**: Returns an associative array of properties to serialize.
- **'__unserialize(array $data): void'**: Re-establishes object state and reconnects resources (e.g. database sockets).

### Security Warning:
**NEVER run 'unserialize()' on untrusted user input!** Unserializing malicious payloads triggers **PHP Object Injection / RCE** attacks via magic methods. Use 'json_encode()' for user data interchange!

Key Takeaway: Use __serialize() / __unserialize() for custom object state export. Never unserialize untrusted user input due to RCE risks.

Question 39

Why must you use password_hash() and password_verify() with BCRYPT/ARGON2ID instead of md5() or sha1()?

Accepted Answer

Fast cryptographic hash functions like MD5, SHA1, or SHA256 must **NEVER be used for passwords**. High-speed GPUs can compute billions of MD5 hashes per second, cracking passwords easily.

### The PHP Password Hashing API:
PHP provides built-in slow key-derivation algorithms resistant to GPU brute-forcing:
- **'password_hash($password, PASSWORD_ARGON2ID)'**: Winner of Password Hashing Competition (enforces memory, time, and thread work factors).
- **'password_hash($password, PASSWORD_BCRYPT)'**: Industry standard algorithm with configurable work cost factor.
- **Automatic Salt**: Generates cryptographically secure random salts automatically per password.
- **'password_verify($input, $hash)'**: Validates passwords using constant-time comparison to prevent timing side-channel attacks.

Key Takeaway: Use password_hash() with PASSWORD_ARGON2ID or BCRYPT and verify with password_verify() to defeat GPU password cracking.

Question 40

How do you validate and sanitize user input securely using filter_var()?

Accepted Answer

Validating and sanitizing incoming user input is essential for web security. PHP provides C-level input filtering via 'filter_var()'.

### 1. Validation Filters (Check input format):
- **'FILTER_VALIDATE_EMAIL'**: Returns valid email string, or 'false' if invalid.
- **'FILTER_VALIDATE_INT'**: Validates integers, supporting range options ('min_range', 'max_range').
- **'FILTER_VALIDATE_URL'**: Validates HTTP/HTTPS URLs.

### 2. Sanitization Filters (Strip bad characters):
- **'FILTER_SANITIZE_NUMBER_INT'**: Strips all characters except digits and '+/-'.
- **'FILTER_SANITIZE_SPECIAL_CHARS'**: Encodes HTML tags to prevent XSS payloads.

Key Takeaway: Use filter_var() with validation filters (FILTER_VALIDATE_EMAIL, FILTER_VALIDATE_INT) for safe input validation.

Question 41

How does the PHP Reflection API inspect classes and power Dependency Injection Autowiring containers?

Accepted Answer

The **Reflection API** allows PHP to inspect class definitions, methods, properties, docblocks, and type hints at runtime.

### How Reflection Powers DI Autowiring Containers:
When a framework container (Laravel Service Container, Symfony Container) needs to instantiate a controller or service:
1. It creates a **'ReflectionClass($className)'** instance.
2. It inspects the constructor methods using **'$reflection->getConstructor()'**.
3. It iterates over constructor parameters using **'$constructor->getParameters()'**, inspecting each parameter's type hint ('$param->getType()->getName()').
4. The container recursively resolves and instantiates those dependencies, auto-injecting them into the newly constructed class!

Key Takeaway: Dependency Injection containers use the Reflection API to inspect constructor type hints and automatically instantiate dependencies.

Question 42

How does PHP Copy-on-Write (CoW) memory management work when passing large arrays?

Accepted Answer

When you assign a large array or string to a new variable ('$b = $a') or pass it to a function, PHP does **NOT make a copy of the memory instantly**.

### How Copy-on-Write (CoW) Works:
1. Both '$a' and '$b' point to the exact same internal 'zval' memory container.
2. PHP increments the internal **'refcount'** pointer ('refcount = 2').
3. Memory is copied **ONLY at the exact moment one of the variables is mutated** ('$b[0] = "new"').
4. If the variable is read without modification, zero extra memory is consumed!

Key Takeaway: PHP Copy-on-Write delays duplicating array memory until the moment a variable is mutated, optimizing RAM usage.

Question 43

What is the difference between self:: and static:: (Late Static Binding) in PHP inheritance?

Accepted Answer

When working with static methods and properties in class inheritance hierarchies:

### 1. 'self::':
- Resolved at **compile-time**.
- Always references the **exact class where the code was written**, ignoring child class overrides.

### 2. 'static::' (Late Static Binding - PHP 5.3+):
- Resolved at **runtime**.
- References the **actual class that invoked the method** (the child class executing the call). Essential for Active Record ORM patterns ('Model::create()').

Key Takeaway: Use static:: (Late Static Binding) instead of self:: to resolve static methods and properties to the calling child class at runtime.

Question 44

How do you convert legacy PHP warnings and notices into fatal exceptions using set_error_handler()?

Accepted Answer

Legacy PHP functions often emit non-fatal **'E_WARNING'** or **'E_NOTICE'** errors (like 'file_get_contents()' failing or missing array keys) instead of throwing exceptions. Silent warnings can pass unhandled, causing downstream bugs.

### Converting Warnings to Exceptions:
Use **'set_error_handler()'** to register a custom error handler callback that wraps all PHP notices and warnings in an **'ErrorException'**, allowing them to be caught cleanly inside standard 'try/catch' blocks!

Key Takeaway: Use set_error_handler() to throw ErrorException on warnings and notices, unifying error handling under try/catch blocks.

Question 45

How do you execute multiple non-blocking HTTP requests in parallel using curl_multi_exec() in PHP?

Accepted Answer

Executing sequential cURL HTTP requests in a loop ('curl_exec()') blocks execution, making 5 API calls taking 1 second each require **5 full seconds total**.

### Parallel Execution with 'curl_multi_exec()':
'curl_multi_exec()' allows executing multiple HTTP requests concurrently on a single PHP thread using non-blocking I/O multiplexing. 5 parallel API calls complete in the time of the single slowest request (~1 second)!

Key Takeaway: Use curl_multi_exec() to execute parallel non-blocking HTTP requests concurrently on a single PHP thread.

Question 46

Why is the PHP 8.0+ match expression superior to the legacy switch statement?

Accepted Answer

PHP 8.0 introduced the **'match' expression** as a modern replacement for 'switch' statements.

### Key Advantages of 'match':
1. **Expression Return Value**: 'match' is an expression that returns a value directly, eliminating boilerplate variable assignment.
2. **Strict Identity Comparison ('===')**: 'match' performs strict type checking ('===') rather than loose comparison ('=='), eliminating loose type bugs (e.g., 'switch' treating '0' as '"0"').
3. **No 'break' Statements Needed**: Executing a matched arm breaks automatically. No accidental fall-through bugs!
4. **Unhandled Match Exception**: Throws an **'UnhandledMatchError'** exception if no case matches and no 'default' is defined.

Key Takeaway: The PHP 8.0 match expression uses strict comparison (===), returns values directly, and prevents missing break fall-through bugs.

Question 47

How does PHP 8.0 Constructor Property Promotion reduce boilerplate class code?

Accepted Answer

In PHP 7, declaring class properties required writing every property name **three times**: once for property declaration, once in the constructor parameters, and once for property assignment ('$this->prop = $prop').

### Constructor Property Promotion (PHP 8.0+):
Prefixing constructor arguments with visibility modifiers ('public', 'protected', 'private', or 'readonly') instructs PHP to automatically declare the property and assign the parameter value in one single statement!

Key Takeaway: Constructor Property Promotion combines property declaration, type hinting, and assignment directly in constructor parameters.

Question 48

How does the PHP 8.0 Nullsafe Operator (?->) prevent "Call to a member function on null" fatal errors?

Accepted Answer

Chaining method calls or property access on potentially null objects historically required clunky nested 'if' checks or ternary operators to avoid fatal "Call to a member function on null" errors.

### The Nullsafe Operator ('?->') (PHP 8.0+):
The Nullsafe operator provides **short-circuit evaluation**: if any element in the method/property chain evaluates to 'null', execution of the rest of the chain is immediately aborted and the entire expression returns 'null'!

Key Takeaway: The Nullsafe Operator (?->) short-circuits method chains if any link is null, returning null without throwing fatal errors.

Question 49

How do PHP 8.0 Named Arguments (func(param: $val)) improve readability and allow skipping optional parameters?

Accepted Answer

Historically, calling a function with many optional parameters required passing positional arguments for every preceding default parameter.

### Named Arguments (PHP 8.0+):
Pass arguments by parameter name using the 'paramName: $value' syntax:
1. **Self-Documenting Code**: Parameter names clarify purpose at call site.
2. **Skip Default Parameters**: Pass specific optional parameters without supplying dummy values for preceding parameters!
3. **Order Independence**: Named arguments can be passed in any order.

Key Takeaway: Named Arguments (func(param: $val)) allow passing parameters by name, improving clarity and allowing skipping default positional arguments.

Question 50

How do readonly properties (PHP 8.1) and readonly classes (PHP 8.2) enforce immutability in DTOs?

Accepted Answer

Creating immutable Data Transfer Objects (DTOs) and Value Objects prevents unintended state mutations across domain services.

### Immutability Evolution:
- **PHP 8.1 'readonly' Properties**: A 'readonly' property can be **written to exactly once** (typically during constructor initialization). Reassigning the property afterwards throws a fatal 'Error' exception.
- **PHP 8.2 'readonly' Classes**: Marking a class as 'readonly' automatically marks **every property in the class as readonly** and prevents adding dynamic properties!

Key Takeaway: Readonly properties (PHP 8.1) and readonly classes (PHP 8.2) enforce immutability by blocking property mutations after initialization.

Question 51

How do Union Types (int|string), Intersection Types (Countable&Traversable), and DNF Types (PHP 8.2) enhance type safety?

Accepted Answer

PHP type system support has evolved to express complex type constraints natively:

### 1. Union Types ('int|string') (PHP 8.0+):
Accepts values that match **at least one** of the specified types.

### 2. Intersection Types ('Countable&Traversable') (PHP 8.1+):
Requires values to satisfy **ALL specified interfaces/types simultaneously**.

### 3. Disjunctive Normal Form (DNF) Types (PHP 8.2+):
Allows combining Union and Intersection types using parenthesized notation: '(HasId&HasName)|null'.

Key Takeaway: Combine Union (|), Intersection (&), and DNF types to declare precise static type constraints in PHP signatures.

Question 52

How do you use PHP 8.1+ Enums and Backed Enums with custom methods and interfaces?

Accepted Answer

PHP 8.1 introduced native **Enums** as first-class object singletons to replace string constant anti-patterns.

### Enum Types:
1. **Pure Enums**: Simple named singleton cases ('enum Status { case Pending; case Active; }').
2. **Backed Enums**: Cases backed by scalar values ('enum Status: string { case Pending = "P"; case Active = "A"; }').
   - **'Status::from("A")'**: Parses scalar value, returning Enum instance (throws 'ValueError' if invalid).
   - **'Status::tryFrom("X")'**: Returns 'null' if scalar value does not match any case.
3. **Enum Methods**: Enums can contain methods, static methods, and implement interfaces!

Key Takeaway: PHP 8.1 Enums replace string constants with type-safe Backed Enums supporting methods, interfaces, and scalar parsing.

Question 53

How do you write unit tests with mock objects and method stubbing using PHPUnit?

Accepted Answer

Unit testing requires isolating the class under test from external dependencies (databases, payment APIs) using **Mock Objects**.

### PHPUnit Mocking Utilities:
- **'$this->createMock(Repository::class)'**: Generates a test double implementing all methods of the target class.
- **'$mock->expects($this->once())'**: Asserts how many times a method must be invoked during test execution.
- **'->method("find")->with(42)->willReturn($user)'**: Configures method stubs to return specific mock data when called with expected arguments.

Key Takeaway: Use PHPUnit $this->createMock() to stub dependency methods and assert call expectations without touching external services.

Question 54

How do you configure custom Composer build scripts and event hooks in composer.json?

Accepted Answer

Composer is not just a dependency manager; it acts as a build tool for PHP projects via **Composer Scripts**.

### Key Script Capabilities:
1. **CLI Command Shortcuts**: Create custom script shortcuts (e.g. 'composer test' to run PHPUnit, or 'composer format' to run PHP-CS-Fixer).
2. **Automated Event Hooks**: Trigger PHP scripts or shell commands automatically on events like 'post-install-cmd' or 'post-autoload-dump'.

Key Takeaway: Configure scripts in composer.json to automate testing pipelines, style checking, and post-installation setup tasks.

Question 55

How do you configure mb_internal_encoding() to prevent character encoding corruption in PHP?

Accepted Answer

Setting internal multibyte encoding ensures that all 'mb_*' string functions operate under a consistent character encoding standard (UTF-8).

### Configuration Best Practices:
1. Call **'mb_internal_encoding("UTF-8");'** in your application bootstrap file.
2. Set **'mb_http_output("UTF-8");'** to ensure HTTP response buffers output in UTF-8.
3. Configure 'php.ini': 'mbstring.internal_encoding = UTF-8'.

Key Takeaway: Set mb_internal_encoding("UTF-8") at bootstrap to ensure all multibyte string operations default to UTF-8 unicode.

Question 56

How do you configure Xdebug 3 for interactive step debugging and profiling in IDEs?

Accepted Answer

**Xdebug 3** is the standard debugging and profiling extension for PHP, replacing legacy 'var_dump()' print debugging with interactive step debugging in IDEs (VS Code, PhpStorm).

### Essential Xdebug 3 php.ini Settings:
- **'xdebug.mode = debug,profile'**: Enables interactive step debugging and cachegrind performance profiling.
- **'xdebug.start_with_request = trigger'**: Triggers Xdebug only when an 'XDEBUG_SESSION' cookie or query parameter is present.
- **'xdebug.client_host = host.docker.internal'**: Directs Xdebug connections back to the developer host machine from inside Docker containers.
- **'xdebug.client_port = 9003'**: Default Xdebug 3 connection port.

Key Takeaway: Configure Xdebug 3 with xdebug.mode=debug and port 9003 to execute interactive step debugging in IDEs.

Question 57

How do you prevent file corruption during concurrent write operations in PHP using flock()?

Accepted Answer

When multiple concurrent PHP-FPM worker processes write to the exact same log file or cache file simultaneously, data corruption occurs due to interleaved write streams. **'flock()'** provides file locking.

### Lock Modes:
- **'LOCK_EX' (Exclusive Lock)**: For write operations. Only one process can hold an exclusive lock; other processes wait.
- **'LOCK_SH' (Shared Lock)**: For read operations. Multiple processes can hold shared locks simultaneously.
- **'LOCK_NB' (Non-Blocking)**: Returns immediately instead of blocking if the lock is held by another process.

Key Takeaway: Acquire an exclusive lock (flock($fp, LOCK_EX)) before writing to files to prevent concurrent file corruption.

Question 58

How do PHP Stream Wrappers work and how do you register custom protocol wrappers?

Accepted Answer

**Streams** are a unified abstraction in PHP for reading/writing streaming data (files, network sockets, compressed archives) in chunked blocks.

### 1. Built-in Stream Wrappers:
- **'php://input'**: Read-only stream to access raw HTTP POST body payloads (JSON/XML).
- **'php://memory' / 'php://temp'**: Temporary memory-backed read/write streams.
- **'zlib://'**: Reads/writes gzipped compressed archives on the fly.

### 2. Custom Stream Wrappers ('stream_wrapper_register()'):
Allows registering custom protocol handlers (e.g. 's3://bucket/file.txt') so standard PHP file functions ('fopen()', 'file_get_contents()') work with cloud storage or custom protocols!

Key Takeaway: PHP Streams provide a unified file and network I/O abstraction. Use php://input to read raw HTTP request payloads.

Question 59

How do you capture rendered view templates or intercept output strings using nested ob_start() and ob_get_clean()?

Accepted Answer

Output Buffering intercepts echoed output in server RAM instead of sending it directly to the web server.

### Capturing View Templates:
To render a PHP template file into a string variable (for sending HTML emails or passing rendered HTML to JSON responses):
1. Call **'ob_start()'** to begin capturing output.
2. Execute 'require' on the PHP view template file.
3. Call **'ob_get_clean()'** to capture the buffered HTML as a string and wipe the buffer!

Key Takeaway: Use ob_start() and ob_get_clean() to capture rendered PHP template output into strings without sending it to the browser.

Question 60

How do you build a custom PSR-4 autoloader from scratch using spl_autoload_register() without Composer?

Accepted Answer

Before Composer, PHP developers registered custom autoloader callbacks using **'spl_autoload_register()'**.

### How Custom PSR-4 Autoloading Works:
1. Register a callback with 'spl_autoload_register($callback)'.
2. When a class is instantiated ('new AppServicesPaymentService()'), PHP passes the fully qualified class name to the callback.
3. The callback converts namespace separators ('') to directory slashes ('/'), appends '.php', and calls 'require' if the file exists!

Key Takeaway: spl_autoload_register() registers custom callback functions to dynamically load class files when instantiated.

Question 61

How does APCu (APC User Cache) provide ultra-fast shared memory user caching for PHP-FPM worker processes?

Accepted Answer

**APCu (APC User Cache)** is an extension that provides an in-memory key-value user data cache stored directly in the server's **OS Shared Memory (SHM)**.

### Performance Advantage:
Unlike Redis or Memcached (which require TCP network socket communication), APCu stores cached variables in local RAM shared across all PHP-FPM worker processes. Reads execute in **sub-microsecond speeds**!

### Common Operations:
- **'apcu_store($key, $val, $ttl)'**: Stores a variable in shared RAM.
- **'apcu_fetch($key)'**: Retrieves a cached variable.
- **'apcu_delete($key)'**: Purges a cached key.

Key Takeaway: APCu caches variables in local OS shared memory across PHP-FPM workers with sub-microsecond retrieval speeds.

Question 62

How do you implement ACID database transactions in PDO using beginTransaction(), commit(), and rollBack()?

Accepted Answer

When executing multi-step database mutations (e.g., deducting funds from Account A and adding funds to Account B), all queries must succeed together or be completely undone. **ACID Transactions** guarantee atomicity.

### PDO Transaction Methods:
1. **'$pdo->beginTransaction()'**: Disables autocommit mode and starts a transaction.
2. **'$pdo->commit()'**: Commits all queries to the database permanently.
3. **'$pdo->rollBack()'**: Cancels all queries executed during the transaction if an exception occurs.

Key Takeaway: Wrap multi-step database updates in PDO beginTransaction() and rollBack() inside try/catch blocks to ensure ACID atomicity.

Question 63

How do you customize JSON output formatting for domain objects by implementing the JsonSerializable interface?

Accepted Answer

By default, passing an object to 'json_encode($obj)' serializes only its **public properties**. Private and protected properties are omitted.

### 'JsonSerializable' Interface:
Implementing the **'JsonSerializable'** interface requires defining a **'jsonSerialize()'** method. This method controls the exact array representation exported whenever 'json_encode()' is invoked on your object, allowing you to sanitize sensitive passwords or format custom JSON field names!

Key Takeaway: Implement JsonSerializable and define jsonSerialize() to customize JSON output and exclude sensitive properties.

Question 64

How do you compile PHP applications and CLI tools into standalone executable PHAR archives?

Accepted Answer

A **PHAR (PHP Archive)** file packages an entire PHP application, source files, template assets, and Composer vendor dependencies into a single executable archive file (similar to Java '.jar' files).

### Use Cases:
Distributing CLI utilities (like Composer itself, PHPUnit, PHP-CS-Fixer, and Laravel Envoy) as single self-contained binary files.

### Key Components:
- **Phar Class**: Build archive from directory.
- **Phar Stub**: Small PHP script executed automatically when the PHAR file is run ('setStub()').

Key Takeaway: PHAR archives package PHP codebases and vendor dependencies into single executable binary files for CLI tool distribution.

Take PHP 8+ Skill Assessment Quiz

Showing 100 Questions

1. What is PHP and how does its shared-nothing request lifecycle work?

The Shared-Nothing Architecture:

Why This Matters:

2. What is the difference between echo and print in PHP?

3. What is the difference between isset(), empty(), and is_null() in PHP?

4. What is the difference between Indexed, Associative, and Multidimensional Arrays in PHP?

5. What does declare(strict_types=1); do in PHP 7+ and why should you use it?

6. What is the difference between single quotes ('') and double quotes ("") in PHP strings?

7. What is the difference between array_merge($a, $b) and the array union operator ($a + $b)?

8. Why is modifying array elements by reference inside foreach ($items as &$item) dangerous and how do you fix it?

9. How does the Null Coalescing Operator (??) differ from the Ternary Operator (?:) and Null Coalescing Assignment (??=)?

10. What is the difference between include, require, include_once, and require_once?

11. How does the Combined Comparison Spaceship Operator (<=>) work in PHP 7+ sorting callbacks?

12. What are PHP Superglobal arrays ($_GET, $_POST, $_SERVER, $_SESSION, $_COOKIE) and how do they work?

13. How do you configure error_reporting() and display_errors in development versus production environments?

14. How do function arguments pass by value versus pass by reference (&$param) in PHP?

15. Why do PHP objects appear to pass by reference by default, and how does object cloning (clone $obj) work?

16. How do PHP 7.4+ short Arrow Functions (fn() => ...) differ from standard anonymous closures?

17. What is the difference between defining constants using define("FOO", 1) versus the const keyword?

18. How do explicit type casting and scalar conversion work in PHP?

19. Why must you use mb_strlen() and mb_substr() instead of strlen() and substr() for UTF-8 multibyte strings?

20. How do json_encode() and json_decode() work and why is the second parameter in json_decode($json, true) critical?

21. How do PHP sessions work internally via PHPSESSID cookies and why must you call session_regenerate_id(true) on login?

22. How do you set secure, tamper-resistant HTTP cookies in PHP using setcookie() with SameSite and HttpOnly flags?

23. Why does calling header("Location: ...") throw "Headers already sent" and how does Output Buffering (ob_start) fix it?

24. Why should you always use the __DIR__ magic constant when including relative files in PHP?

25. What is the difference between var_dump(), print_r(), and var_export() for variable debugging?

26. Why should you always use DateTimeImmutable over DateTime for date and time calculations in PHP?

27. How do functional array manipulation methods (array_map, array_filter, array_reduce) work in PHP?

28. Why should you catch Throwable instead of Exception in PHP 7+ global error handlers?

29. How do PHP namespaces prevent class naming collisions and how does the use keyword alias imports?

30. How do you inspect PHP environment extensions, memory limits, and configuration settings using phpinfo() and ini_get()?

31. What are PHP Traits and how do they solve single inheritance limitations?

32. How does PDO (PHP Data Objects) prevent SQL Injection using Prepared Statements?

33. How does Composer PSR-4 Autoloading work with PHP Namespaces?

34. How do PHP Generators (yield keyword) process massive datasets without exhausting memory_limit?

35. How do PHP 7+ Anonymous Classes work and why are they useful in unit testing?

36. What is the SPL (Standard PHP Library) and when should you use SplFixedArray, SplQueue, or SplHeap?

37. How do PHP dunder magic methods (__get, __set, __call, __toString, __invoke) power dynamic object overloading?

38. How do serialize() and unserialize() work with __serialize() and __unserialize() in PHP 7.4+?

39. Why must you use password_hash() and password_verify() with BCRYPT/ARGON2ID instead of md5() or sha1()?

40. How do you validate and sanitize user input securely using filter_var()?

41. How does the PHP Reflection API inspect classes and power Dependency Injection Autowiring containers?

42. How does PHP Copy-on-Write (CoW) memory management work when passing large arrays?

43. What is the difference between self:: and static:: (Late Static Binding) in PHP inheritance?

44. How do you convert legacy PHP warnings and notices into fatal exceptions using set_error_handler()?

45. How do you execute multiple non-blocking HTTP requests in parallel using curl_multi_exec() in PHP?

46. Why is the PHP 8.0+ match expression superior to the legacy switch statement?

47. How does PHP 8.0 Constructor Property Promotion reduce boilerplate class code?

48. How does the PHP 8.0 Nullsafe Operator (?->) prevent "Call to a member function on null" fatal errors?

49. How do PHP 8.0 Named Arguments (func(param: $val)) improve readability and allow skipping optional parameters?

50. How do readonly properties (PHP 8.1) and readonly classes (PHP 8.2) enforce immutability in DTOs?

51. How do Union Types (int|string), Intersection Types (Countable&Traversable), and DNF Types (PHP 8.2) enhance type safety?

52. How do you use PHP 8.1+ Enums and Backed Enums with custom methods and interfaces?

53. How do you write unit tests with mock objects and method stubbing using PHPUnit?

54. How do you configure custom Composer build scripts and event hooks in composer.json?

55. How do you configure mb_internal_encoding() to prevent character encoding corruption in PHP?

56. How do you configure Xdebug 3 for interactive step debugging and profiling in IDEs?

57. How do you prevent file corruption during concurrent write operations in PHP using flock()?

58. How do PHP Stream Wrappers work and how do you register custom protocol wrappers?

59. How do you capture rendered view templates or intercept output strings using nested ob_start() and ob_get_clean()?

60. How do you build a custom PSR-4 autoloader from scratch using spl_autoload_register() without Composer?

61. How does APCu (APC User Cache) provide ultra-fast shared memory user caching for PHP-FPM worker processes?

62. How do you implement ACID database transactions in PDO using beginTransaction(), commit(), and rollBack()?

63. How do you customize JSON output formatting for domain objects by implementing the JsonSerializable interface?

64. How do you compile PHP applications and CLI tools into standalone executable PHAR archives?

65. How do you send data back into a running PHP Generator coroutine using $generator->send($val)?

66. How do you configure error_log() and syslog() for centralized log monitoring in Docker containers?

67. How do you implement currency formatting and date localization using the PHP Intl extension?

68. How do you register a global exception fallback handler using set_exception_handler() to render clean error pages?

69. How do you make HTTP POST requests with custom headers using file_get_contents() and stream_context_create()?

70. How does the PHP 8.2+ #[SensitiveParameter] attribute redact passwords and API keys from stack traces on fatal crashes?

71. How does PHP OPcache and the PHP 8+ JIT (Just-In-Time) Compiler work internally?

72. How do PHP 8.1+ Fibers enable asynchronous concurrency and how do they integrate with Revolt / AMPHP / ReactPHP?

73. How does PHP Garbage Collection (gc_collect_cycles) work and how do WeakMaps prevent memory leaks in long-running daemons?

74. How do you use PHP 7.4+ FFI (Foreign Function Interface) to bind native C/Rust shared libraries directly in PHP?

75. How does Swoole / OpenSwoole transform PHP into an asynchronous, event-driven, multi-threaded application server?

76. How does Laravel Octane supercharge application performance using Swoole or RoadRunner?

24. Why should you always use the DIR magic constant when including relative files in PHP?

37. How do PHP dunder magic methods (get, set, call, toString, __invoke) power dynamic object overloading?

38. How do serialize() and unserialize() work with serialize() and unserialize() in PHP 7.4+?