Guides
Every section we cover, with the explainers that go with it.
Composer and standards
Model
- How do I manage PHP configuration and secrets? Separate PHP configuration and secrets from committed code using environment variables—here is the difference between .env files and php.ini and the production caching pitfall.
- How does Composer work? Composer manages PHP dependencies through a lock file that guarantees reproducible builds—here is the difference between install and update and why it matters.
- How does PHP autoloading work? PSR-4 maps PHP namespaces to directory structures, and Composer generates the autoloader that enforces this mapping—learn how they work together.
- How should I structure a PHP project? A framework-neutral PHP project structure separates public entry points from application source using PSR-4 and Composer conventions—here is the durable layout.
- What are PHP Standards Recommendations? PHP Standards Recommendations solve interop problems across frameworks—here is which PSRs matter, which are stable, and how the PHP-FIG process works.
Databases and testing
Model
- How do database transactions work in PHP? How PHP database transactions with PDO provide atomicity, why external side effects survive rollback, and how isolation levels affect South Florida MySQL deployments.
- How do I unit test PHP code? Write PHP unit tests with PHPUnit that use real isolation, one assertion per test, and mutation-surviving coverage beyond vanity CI badges.
- How do prepared statements prevent SQL injection? How PHP prepared statements with PDO prevent SQL injection on values, why identifiers still need whitelisting, and the remaining risks to address.
- PDO or an ORM? Compare raw PDO against PHP ORMs on control, query visibility, migrations, and the N+1 problem, including South Florida shared-hosting portability traps.
- What is the PHP testing pyramid? How to balance unit, integration, and end-to-end PHP tests using PHPUnit, with a focus on the mutation-surviving coverage that South Florida employers expect.
Frameworks and APIs
Model
- Do I need a PHP framework? Decide whether your PHP project needs a framework by weighing complexity, maintenance overhead, and team familiarity—here are the transferable criteria before any specific framework enters the discussion.
- How do I build a REST API in PHP? Design a REST API in PHP with PSR-7 responses, correct status codes, input validation, and error handling that works across frameworks.
- How do routing and middleware work? How PHP routing and middleware use PSR-7 messages and PSR-15 handlers to build a request pipeline, with framework-neutral concepts first.
- How should PHP applications authenticate users? Authenticate PHP users with password hashing, secure session cookies, CSRF protection, and token boundaries, including South Florida shared-hosting session risks.
- Laravel or Symfony? Laravel dominates South Florida job listings with its paid ecosystem, while Symfony appears in enterprise and healthcare—compare their philosophies and components without a universal winner.
PHP language
Model
- How do PHP classes and interfaces work? PHP classes and interfaces enforce contracts through visibility rules and type declarations; modern PHP favours composition with readonly classes and constructor promotion.
- How do PHP types work? PHP type declarations control how values flow through code: strict mode throws TypeErrors on mismatch, while coercive mode silently converts where possible.
- How does modern PHP differ from old PHP? Modern PHP 8.x differs from old PHP in its type system, tooling conventions, and Composer-based dependency management—not just syntax additions.
- How should PHP handle errors and exceptions? PHP error handling separates detection, display, and logging: production must log everything but display nothing, using E_ALL without E_DEPRECATED or E_STRICT.
- What are attributes, enums and readonly properties? PHP attributes (8.0), enums (8.1), readonly properties (8.1), readonly classes (8.2), and fibers (8.1) are version-gated features with specific syntax and failure modes.
Security and production
Model
- How do I debug a slow PHP application? Use measurement, Xdebug profiling, MySQL slow-query analysis, and opcache inspection in that order to find and fix a slow PHP application.
- How do I prevent XSS and CSRF in PHP? Defend against XSS with output encoding and CSP headers, and prevent CSRF with session-bound tokens, following OWASP guidance for PHP applications.
- How do I secure a PHP application? A risk-prioritised security checklist for PHP applications, built on OWASP guidance and covering the lifecycle from dependency audit to production configuration.
- How does PHP run in production? How PHP-FPM workers and opcache combine to serve requests in production, and how to configure them for the South Florida hosting landscape.
- How should PHP store passwords? Use PHP's built-in password_hash with argon2id to store passwords securely, including a migration strategy from legacy hashes with password_needs_rehash.