PHP interviews still ask how you prevent SQL injection, how sessions work, and whether you know ===, namespaces, and Composer. Be ready to write a PDO prepared statement from memory and to explain XSS escaping in views. Framework names (Laravel) are extra — language fundamentals are the filter.
This PHP cheat sheet is written for people searching for a fast, accurate reference: students, junior developers, and teams shipping production software. Pin it, copy the snippets, and come back when syntax slips.
Quick reference
- ===: No coercion. Use for status strings and IDs.
- PDO: Prepared statements with bound parameters. No string-concat SQL.
- Session:
session_start(); $_SESSION["uid"]. Server-side. Cookies hold the session id. - XSS:
htmlspecialcharsin HTML context. Different escaping for attrs/JS/URLs. - include vs require:
requirefatals if missing.require_oncefor files that must load once. - PSR-4: Composer autoload. Know
vendor/autoload.php. - Types: PHP 8 type errors vs old silent coercions — mention
strict_types. - Public dir: Only
public/(or htdocs docroot) is web-reachable. Config stays above it when you can.
Copy-paste examples
PDO select with a bound id
This is the answer they want when they ask “how do you query by id?”
<?php
function findUser(PDO $pdo, int $id): ?array
{
$stmt = $pdo->prepare('SELECT id, email FROM users WHERE id = :id');
$stmt->execute(['id' => $id]);
$row = $stmt->fetch(PDO::FETCH_ASSOC);
return $row === false ? null : $row;
}Common mistakes
- Answering SQL injection with “I use MySQLi real_escape_string” as the only defense.
- Storing passwords in plaintext or MD5.
- Cannot explain session fixation or why
HttpOnlycookies matter. - Mixing business logic in
index.phpas the architecture answer.
FAQ
- GET vs POST? GET is bookmarkable and should not change state. POST for writes. PUT/PATCH/DELETE exist in APIs; browsers’ HTML forms natively do GET/POST.
- What is Composer? PHP’s dependency manager.
composer.jsonplus autoload. Like npm for PHP libraries.
- Laravel vs plain PHP in interviews? Say you can ship without a framework, then name what Laravel gives you (routing, Eloquent, Blade, queues).
Related PHP cheat sheets
Build with this stack
When a cheat sheet is not enough — you need a production app, a student FYP, or a custom dashboard — ArpaNeuro builds custom web development and also sells ready-made source code. Request a quote and tell us the stack.
Browse software development services or the source code marketplace if you want a working codebase instead of starting from a blank file.