PHP interview questions

What a strong answer covers

• `echo` can output multiple strings separated by commas, while `print` can only output a single string.
• `echo` is a language construct and has no return value, making it marginally faster.
• `print` is also a language construct but returns an integer value of 1 on success, which can be used in expressions.
• Both `echo` and `print` are used to output strings to the browser or console.

Where people lose the point

• ×Stating that `echo` and `print` are identical in all aspects.
• ×Incorrectly describing the return value of `print` or claiming `echo` has one.

What a strong answer covers

• `include` will generate a `E_WARNING` if the specified file cannot be found or accessed, but the script will continue execution.
• `require` will generate a `E_COMPILE_ERROR` (a fatal error) if the specified file cannot be found or accessed, and the script execution will be halted.
• Both `include_once` and `require_once` variants exist to ensure that a file is included or required only once during the script's execution, preventing redeclaration errors.
• The choice between `include` and `require` depends on whether the included file is essential for the script's functionality.

Where people lose the point

• ×Confusing the error levels (warning vs. fatal error) generated by each statement.
• ×Not mentioning the `_once` variants and their purpose.

What a strong answer covers

• PHP superglobals are built-in variables that are always available in all scopes throughout a script, meaning they can be accessed from any function, class, or file without needing `global` keyword.
• `$_GET` is an associative array of variables passed to the current script via the URL parameters (HTTP GET method).
• `$_POST` is an associative array of variables passed to the current script via the HTTP POST method, typically from an HTML form.
• `$_SESSION` is an associative array containing session variables available to the current script, used for maintaining user state across multiple page requests.
• `$_SERVER` is an associative array containing information created by the web server, headers, and script locations.

Where people lose the point

• ×Listing regular global variables instead of actual superglobals.
• ×Misunderstanding that superglobals are accessible in all scopes without explicit declaration.

What a strong answer covers

• Type juggling (or automatic type conversion) is PHP's behavior of automatically converting a value from one data type to another when an operator or function expects a different type.
• Type coercion refers to the process of converting a value from one data type to another, which can be implicit (juggling) or explicit (e.g., `(int) $var`).
• This behavior can be convenient but also a source of unexpected results or bugs due to loose comparisons (e.g., `==`).
• `declare(strict_types=1);` is a directive that, when placed at the top of a PHP file, enforces strict type checking for function arguments and return values within that file, preventing automatic type juggling in those specific contexts.

Where people lose the point

• ×Confusing type juggling with strict typing, or believing PHP is strictly typed by default.
• ×Not explaining the specific impact of `declare(strict_types=1);` on type coercion.

What a strong answer covers

• `public` members (properties and methods) are accessible from anywhere: within the class itself, by inheriting child classes, and from outside the class instance.
• `protected` members are accessible within the class that defines them and by any class that inherits from it (child classes), but not from outside the class hierarchy.
• `private` members are accessible only within the class that defines them. They are not accessible by inheriting child classes or from outside the class instance.
• Access modifiers are fundamental to encapsulation, controlling visibility and preventing unauthorized access or modification of an object's internal state.

Where people lose the point

• ×Confusing `protected` with `private` regarding access from child classes.
• ×Incorrectly stating that `private` members are accessible by child classes.

What a strong answer covers

• An abstract class can have both abstract methods (without implementation) and concrete methods (with implementation), as well as properties. A class can extend only one abstract class.
• An interface can only define method signatures (without implementation) and constants. It cannot have properties or concrete methods. A class can implement multiple interfaces.
• Use an abstract class when you want to provide a common base implementation for a group of related classes, sharing some functionality while forcing specific methods to be implemented by children.
• Use an interface when you want to define a contract that multiple unrelated classes must adhere to, ensuring they provide a specific set of behaviors without dictating their internal structure.

Where people lose the point

• ×Stating that abstract classes cannot have properties or concrete methods.
• ×Believing interfaces can contain method bodies or properties.

What a strong answer covers

• Traits are a mechanism for code reuse in single inheritance languages like PHP. They allow a class to use methods from multiple traits, effectively simulating horizontal reuse of functionality.
• Traits were introduced to address the limitations of single inheritance, providing a way to reuse sets of methods freely in independent classes without requiring them to be part of the same inheritance hierarchy.
• When a trait is used in a class, its methods are injected into the class, making them available as if they were defined directly in the class.
• They help reduce code duplication and promote modularity by allowing developers to compose classes from fine-grained units of functionality.

Where people lose the point

• ×Confusing traits with interfaces or abstract classes, which serve different purposes.
• ×Not explaining that traits address the single inheritance limitation in PHP.

What a strong answer covers

• Errors are traditional PHP runtime problems (e.g., parse errors, warnings, fatal errors) that typically halt script execution or produce warnings. They are handled by PHP's internal error handling mechanism or a custom error handler set with `set_error_handler()`.
• Exceptions are objects that represent an exceptional condition or an unexpected event during program execution. They are designed for structured error handling using `try-catch` blocks.
• Exceptions allow for more graceful recovery, clearer separation of error-handling code from regular program logic, and can be caught and handled at different levels of the application.
• While some errors can be converted to exceptions (e.g., via `ErrorException`), not all traditional PHP errors can be caught by `try-catch` blocks (e.g., fatal errors like parse errors).

Where people lose the point

• ×Stating that all PHP errors can be caught using `try-catch` blocks.
• ×Not distinguishing between the mechanisms for handling errors (`set_error_handler`) and exceptions (`try-catch`).

What a strong answer covers

• PDO prepared statements separate the SQL query structure from the actual data values. The query is sent to the database server first, where it is parsed and compiled.
• They prevent SQL injection attacks by ensuring that user-supplied data is treated as literal values, not as executable SQL code. Any special characters in the data are automatically escaped or handled by the database.
• When `execute()` is called with parameters, the database binds these values to the placeholders in the pre-compiled query, eliminating the risk of malicious code being injected.
• Prepared statements also offer performance benefits for queries executed multiple times, as the database only needs to parse the query once.

Where people lose the point

• ×Believing that simply escaping strings (e.g., `mysql_real_escape_string`) is a sufficient and modern security practice.
• ×Not explaining *how* prepared statements prevent SQL injection (separation of query and data, parameter binding).

What a strong answer covers

• Composer is a dependency manager for PHP. It allows you to declare the libraries your project depends on and it will install and manage them for you, ensuring consistent environments across development teams.
• Its autoloading feature automatically loads classes as they are needed, eliminating the need for manual `require` or `include` statements for every class file.
• Composer generates an `autoload.php` file, which maps namespaces and class names to their corresponding file paths, typically following PSR-4 or PSR-0 standards.
• This significantly simplifies project setup, improves code organization, and makes it easier to integrate third-party libraries into a PHP application.

Where people lose the point

• ×Confusing Composer with a package repository or a simple file inclusion tool.
• ×Not explaining the mechanism of autoloading (mapping namespaces/classes to file paths).

What a strong answer covers

• PHP handles session management by storing user-specific data on the server across multiple page requests. This data is associated with a unique session ID.
• The session ID is typically transmitted between the client and server via a cookie (PHPSESSID) or, less commonly, as a URL parameter.
• The `session_start()` function initializes a new session or resumes an existing one. It must be called before any output is sent to the browser.
• Once `session_start()` is called, the `$_SESSION` superglobal array becomes available for storing and retrieving session variables, allowing data to persist for the duration of the user's session.

Where people lose the point

• ×Believing that session data is stored directly on the client-side (e.g., in cookies).
• ×Forgetting to mention the necessity of calling `session_start()` before using `$_SESSION`.

What a strong answer covers

• PHP magic methods are special methods in classes that start with a double underscore (`__`) and are invoked automatically by PHP in response to certain events or actions.
• `__get($name)` is called when attempting to read an inaccessible (private or protected) or non-existent property of an object.
• `__set($name, $value)` is called when attempting to write to an inaccessible or non-existent property of an object.
• A common use case for `__get()` and `__set()` is property overloading, allowing dynamic access to properties, implementing lazy loading for properties, or logging property access/modification.

Where people lose the point

• ×Misunderstanding when magic methods are invoked (e.g., thinking `__get` is called for all property reads).
• ×Not providing a concrete and practical use case for `__get()` and `__set()`.

What a strong answer covers

• Type hinting (or type declarations) in PHP allows developers to specify the expected data type for function parameters, return values, and class properties.
• It improves code readability, makes code easier to maintain, and enables static analysis tools to catch potential type-related errors early.
• While PHP is dynamically typed, type declarations provide a way to add a layer of type safety and predictability to your code.
• Example: `function calculateSum(int $a, int $b): int { return $a + $b; }` where `int` specifies the expected type for parameters and the return value.

Where people lose the point

• ×Believing that PHP is strictly typed by default without `declare(strict_types=1);`.
• ×Not providing a clear and correct code example demonstrating type declarations.

What a strong answer covers

• A Closure, also known as an anonymous function, is a function that does not have a name. It can be assigned to a variable and passed as an argument to other functions.
• Closures can 'capture' variables from the scope in which they were defined, allowing them to access and use those variables even after the original scope has exited. This is done using the `use` keyword.
• They are often used for callbacks, such as sorting arrays with custom logic (`usort`), filtering collections, or defining short, inline logic where a full named function is unnecessary.
• Example use case: `array_map(function($item) { return $item * 2; }, [1, 2, 3]);`

Where people lose the point

• ×Confusing closures with regular named functions.
• ×Forgetting the `use` keyword when a closure needs to access variables from its parent scope.

What a strong answer covers

• The `static` keyword can be applied to properties and methods within a class, making them belong to the class itself rather than to any specific instance of the class.
• Static properties and methods are accessed directly on the class using the scope resolution operator (`::`), e.g., `ClassName::staticMethod()` or `ClassName::$staticProperty`.
• Static methods can only access static properties and other static methods within the same class; they cannot access instance-specific properties or methods using `$this`.
• The `static` keyword can also be used for variables within a function, causing them to retain their value between successive calls to that function.

Where people lose the point

• ×Believing that static methods can access instance properties or methods using `$this`.
• ×Not differentiating between static class members and static variables within a function.