PHP — Cheat Sheet

Tags: php, backend, oop, composer, pdo, symfony, laravel

Level: intermediate

TL;DR: Modern PHP reference covering type systems, OOP features, PSR standards, memory management, and secure web application patterns.

Key concepts

PHP executes in a shared-nothing architecture where state resets completely after each HTTP request.

OPcache improves performance by storing precompiled script bytecode in shared memory.

Type declarations support scalar types, union types, intersection types, and never return types.

Constructor property promotion reduces boilerplate by declaring and assigning class properties directly in __construct.

Attributes provide structured, native machine-readable metadata directly integrated into PHP reflection.

Match expressions provide strict type comparison (===) and return values without requiring explicit break statements.

Prepared statements via PDO prevent SQL injection by strictly separating SQL query logic from data inputs.

Composer manages dependencies and handles class autoloading adhering strictly to PSR-4 standards.

Fibers enable cooperative multitasking and non-blocking concurrency within a single PHP process.

The garbage collector uses reference counting alongside a cycle collector to reclaim cyclic memory references.

Typical questions and ready answers

Q: How does modern PHP handle type safety compared to older versions?R: Modern PHP uses strict typing via declare(strict_types=1);, enforcing precise parameter and return types across union, intersection, and nullable types while avoiding silent type coercion.

Q: What is the difference between == and ===?R: == performs type coercion before comparison, whereas === requires both operand values and data types to be strictly identical.

Q: How do you prevent SQL injection vulnerabilities in PHP?R: I always use PDO or MySQLi with parameterized queries and prepared statements, ensuring user parameters are never concatenated directly into SQL strings.

Q: What is PSR-4 and why does it matter?R: PSR-4 is the autoloading standard mapping namespace prefixes directly to base directory file paths, letting Composer autoload classes deterministically without manual includes.

Pitfalls and common mistakes

Omitting declare(strict_types=1); allows PHP to silently coerce incompatible argument types in function calls.

Using empty() on string "0" or integer 0 evaluates to true, causing unexpected logical bypasses.

Calling password_hash() without using the constant PASSWORD_DEFAULT or PASSWORD_BCRYPT leads to weak authentication storage.

Modifying array values by reference in a foreach (&$val) loop without unsetting &$val afterwards mutates subsequent array elements.

Relying on unserialize() on untrusted input introduces remote code execution vulnerabilities via object injection.

Snippets and commands

<?php

declare(strict_types=1);

namespace App\Services;

use PDO;

final readonly class UserService
{
    public function __construct(
        private PDO $db,
    ) {}

    public function findEmailById(int $id): ?string
    {
        $stmt = $this->db->prepare('SELECT email FROM users WHERE id = :id');
        $stmt->execute(['id' => $id]);
        $email = $stmt->fetchColumn();

        return $email !== false ? (string) $email : null;
    }
}

Bash

# Start built-in web server
php -S localhost:8000 -t public/

# Run interactive REPL
php -a

# Run composer autoload optimization
composer dump-autoload -o --no-dev

To review

[ ] Fiber life cycle and event-loop integration with frameworks like Revolt

[ ] JIT compilation configuration in php.ini (opcache.jit, opcache.jit_buffer_size)

[ ] Weak references and WeakMap implementations for memory-leak prevention

[x] Constructor property promotion and readonly classes

[x] PDO prepared statements and parameter binding modes

References

PHP Official Documentation (php.net)

PHP-FIG PSR Specifications (PSR-1, PSR-4, PSR-7, PSR-12)

OWASP PHP Security Cheat Sheet

Jarvis Interviews
Jarvis