PHP runs a large share of the web, including WordPress, Laravel and many Indian business websites. These PHP interview questions cover syntax, arrays, sessions and forms for freshers, then OOP, Composer, security, PDO, performance and modern PHP 8 features for experienced PHP developers.
30 questions · Updated
Fundamentals, definitions and simple scenarios. Good for freshers and warm-ups.
PHP is a server-side scripting language designed for web development.
It runs on the server, generates HTML or JSON and sends it to the browser.
It powers WordPress, Laravel, Magento, Drupal and many custom websites and APIs, and is supported by almost every web host.
echo and print both output text; echo can take multiple arguments and is slightly faster, while print returns 1 so it can be used in expressions. include adds a file and only issues a warning if it is missing, so the script continues. require stops with a fatal error if the file is missing. include_once and require_once prevent the same file being loaded twice.
Cookies store small data in the user's browser and are sent with every request.
Sessions store data on the server, and only a session ID is kept in a cookie.
Sessions are better for sensitive data such as the logged-in user, because the user cannot see or change the data. session_start() begins a session and $_SESSION stores values.
Scalar types (int, float, string and bool), compound types (array, object, callable and iterable), and special types (null and resource). PHP is dynamically typed, so a variable's type depends on its value, but you can declare parameter, return and property types, and with declare(strict_types=1) PHP enforces them strictly instead of converting values.
== compares values after type juggling, so "10" == 10 is true. === also compares types, so "10" === 10 is false. PHP 8 made string-to-number comparison safer (0 == "abc" is now false), but === is still recommended to avoid surprises, especially with functions such as strpos that can return 0 or false.
Indexed arrays with numeric keys, associative arrays with string keys such as ["name" => "Ravi", "city" => "Pune"], and multidimensional arrays containing other arrays.
All are ordered maps underneath.
Common functions include count, in_array, array_key_exists, array_map, array_filter, array_reduce, array_merge, usort and array_column.
Superglobals are built-in arrays available everywhere: $_GET and $_POST for request data, $_REQUEST combining them, $_SERVER for server and request information, $_SESSION for session data, $_COOKIE, $_FILES for uploads, $_ENV for environment variables and $GLOBALS. Values from them come from users, so they must always be validated.
Create a PDO object with a DSN, username and password, set the error mode to exceptions, and use prepared statements for every query with user input. PDO works with many databases through the same API.
$pdo = new PDO('mysql:host=localhost;dbname=shop;charset=utf8mb4', $user, $pass, [
PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
]);
$stmt = $pdo->prepare('SELECT id, name FROM products WHERE category = ?');
$stmt->execute([$category]);
$products = $stmt->fetchAll();isset returns true if a variable exists and is not null. empty returns true if a variable does not exist or has a falsy value, such as "", "0", 0, null, false or an empty array. is_null returns true only when the value is null, and warns if the variable is undefined. The null coalescing operator ?? is a concise way to provide defaults.
Declare types and defaults in the signature, such as function price(float $amount, float $tax = 0.18): float.
Nullable types use ?string, union types string|int, and named arguments let callers skip optional parameters, as in price(amount: 100, tax: 0.05).
Variadic parameters (...$items) accept any number of arguments.
Single-quoted strings are literal, while double-quoted strings interpolate variables, such as "Hello $name", and escape sequences like \n.
Strings are joined with the dot operator.
Useful functions include strlen, str_contains, str_starts_with, str_replace, substr, explode, implode, trim and sprintf, and the mb_ functions handle multibyte text such as Hindi correctly.
Applied problems, trade-offs and questions about your own projects.
GET sends data in the URL query string, read with $_GET, which is visible, bookmarkable and limited in length, and suits searches and filters.
POST sends data in the request body, read with $_POST, which suits forms that change data, logins and file uploads.
Neither is secure without HTTPS, and all input must be validated.
Use prepared statements with bound parameters through PDO or MySQLi, for example $stmt = $pdo->prepare('SELECT * FROM users WHERE email = ?'); $stmt->execute([$email]).
The query and data are sent separately, so input cannot change the SQL.
Never build queries by concatenating user input.
ORMs such as Eloquent or Doctrine use prepared statements internally.
Composer is PHP's dependency manager. composer.json lists the packages a project needs, composer.lock records exact versions, and composer install downloads them into the vendor folder. It also generates an autoloader following PSR-4, so classes load automatically from their namespaces without manual require statements.
Traits let you reuse methods across classes without inheritance, since PHP supports only single inheritance.
A trait is declared with the trait keyword and added to a class with use.
They suit shared behaviour such as logging or soft deletes, as Laravel uses them heavily, but overusing them can make code harder to follow.
PHP supports classes with properties and methods, visibility (public, protected, private), constructors with property promotion, inheritance with extends (single inheritance), interfaces with implements, abstract classes, traits for code reuse, static members, readonly properties and enums. Type declarations on properties and methods make classes robust.
PSRs are recommendations from the PHP-FIG group that let frameworks and libraries work together. Important ones are PSR-4 (autoloading classes from namespaces and folders), PSR-12 and PER coding style, PSR-3 (logger interface), PSR-7 and PSR-17 (HTTP messages), PSR-11 (container interface) and PSR-15 (HTTP middleware).
Inside a class, self:: refers to the class where the method is written, while static:: refers to the class that was actually called at runtime.
So a parent method using new static() or static::create() creates an instance of the child class when called on the child.
It is used in fluent APIs and Active Record models such as Eloquent.
Magic methods start with two underscores and are called automatically: __construct and __destruct, __get and __set for inaccessible properties, __call and __callStatic for undefined methods, __toString for string conversion, __invoke to call an object like a function, __clone, __isset and __unset. Frameworks use them heavily, but overusing them hides behaviour.
Most errors in PHP 8 throw Error or Exception objects that can be caught with try/catch, with finally for cleanup.
Throw specific exception classes for different failures, catch them where you can handle them, and set a global exception handler that logs details and shows a friendly page.
In production, display_errors must be off and log_errors on.
By default PHP converts values to match declared scalar types, so passing "5" to an int parameter works.
With declare(strict_types=1) at the top of a file, function calls from that file must pass exactly the declared types, otherwise a TypeError is thrown.
It catches bugs early and is standard in modern PHP projects.
Anonymous functions (closures) can be stored in variables and passed as callbacks, capturing outside variables explicitly with use ($rate), or by reference with use (&$total).
Arrow functions, such as fn($x) => $x * $rate, are single-expression closures that capture outer variables automatically by value.
They are common with array_map, array_filter and usort.
System design, deep internals, leadership and tough follow-ups.
The JIT compiler, named arguments, union types, the nullsafe operator ?->, match expressions, constructor property promotion, attributes, and str_contains (PHP 8.0).
PHP 8.1 added enums, readonly properties, fibers and first-class callable syntax.
Later versions added readonly classes, typed class constants and property hooks (PHP 8.4).
Use prepared statements, escape output with htmlspecialchars to prevent XSS, protect forms with CSRF tokens, hash passwords with password_hash and verify with password_verify, validate and limit file uploads by type and size and store them outside the web root, regenerate session IDs on login, use secure cookie flags, disable error display in production, and keep PHP and dependencies updated.
Use a supported PHP 8 version, enable OPcache so scripts are not recompiled on each request, use PHP-FPM with a tuned process count, cache data and queries in Redis or Memcached, optimise slow database queries and add indexes, use Composer's optimised autoloader, and profile with Xdebug or Blackfire to find bottlenecks.
A web server such as Nginx passes PHP requests to PHP-FPM, which keeps a pool of worker processes.
For each request, a worker runs the script from start to finish and then discards all state, which is called shared-nothing.
This makes PHP simple and robust, since memory leaks and crashes do not persist, and OPcache avoids recompiling scripts.
Long-running runtimes such as Swoole, RoadRunner and FrankenPHP keep the app in memory instead.
PHPUnit is the standard testing framework, and Pest offers a more expressive syntax on top of it.
Unit tests cover classes in isolation with mocks, and integration tests use a test database.
Static analysis with PHPStan or Psalm catches type errors without running code, and tools such as Rector automate refactoring and upgrades.
A container creates objects and supplies their dependencies automatically, usually by reading constructor type hints (autowiring), so classes receive what they need instead of creating it.
This makes code loosely coupled and testable.
Laravel's service container and Symfony's DependencyInjection component are common; PHP-DI is a standalone option following PSR-11.
Traditional PHP handles one request per worker and exits.
For background work, queues with workers (Laravel queues, Symfony Messenger) are standard.
Fibers (PHP 8.1) provide the foundation for asynchronous libraries such as ReactPHP and AMPHP, and Swoole, RoadRunner and FrankenPHP run PHP as long-lived servers with much higher throughput, which requires careful handling of shared state.
Add tests around critical behaviour first, then upgrade PHP versions step by step with Rector and PHPStan, introduce Composer and autoloading, replace raw mysql_ functions with PDO prepared statements, extract logic from templates into classes, and gradually move routes into a framework such as Laravel or Symfony using the strangler pattern. Deploy small changes often.
See all Backend Developer interview questions, covering Node.js, Express.js, NestJS, Python, Django and more.