PHP
PHP is a pragmatic, server-side language built for the web. It runs a staggering share of the internet — including WordPress, which alone powers a large fraction of all websites — and benefits from ubiquitous, cheap hosting.
Modern PHP (8+) is a different language from its early-2000s reputation: it has scalar type hints, union types, enums, attributes, readonly properties, just-in-time compilation, a great package manager (Composer), and mature frameworks (Laravel, Symfony). It remains one of the fastest ways to ship a server-rendered web app.
TL;DR
- A pragmatic server-side web language with huge hosting support.
- Modern PHP 8 has strong typing, enums, attributes, and
readonly. - Composer is the standard package manager (PSR-4 autoloading).
- Laravel and Symfony are the dominant frameworks.
Quick Example
strict_types plus type hints make modern PHP feel like a typed language:
Core Concepts
Modern type system
PHP 8 added scalar type hints and return types, union types, enums (8.1+), readonly properties (8.1+), and attributes (annotations). Enable declare(strict_types=1) for fewer surprising coercions.
Composer & autoloading
Composer is the standard package manager — it manages dependencies, defines PSR-4 autoloading, and locks versions for reproducible builds (composer.lock).
Frameworks
- Laravel — batteries-included, rapid development, huge ecosystem.
- Symfony — composable components, enterprise-friendly.
- Slim — minimal API framework.
Performance & Scaling
- Enable OPcache in production (caches compiled bytecode — a big win).
- Push heavy work out of the request path into queued background jobs.
- Add a cache layer (Redis/Memcached) for expensive computations.
Security
- Prepared statements (PDO) to prevent SQL injection.
- Validate/sanitize input server-side; escape output in templates to prevent XSS.
- Store passwords with
password_hash()and verify withpassword_verify(). - Keep dependencies updated and audit Composer packages.
Testing & Quality
- PHPUnit for unit/integration tests.
- Static analysis with PHPStan or Psalm.
- Formatting with PHP-CS-Fixer.
Best Practices
- Turn on
strict_typesand type everything you can. - Use Composer and PSR standards; commit
composer.lock. - Store times in UTC; format at boundaries.
- Be explicit about arrays-as-lists vs arrays-as-maps.
Common Mistakes
Building SQL with string interpolation
Storing passwords insecurely
FAQ
Isn't PHP outdated?
Its early reputation predates modern PHP. PHP 8 has a real type system, enums, attributes, JIT compilation, and excellent frameworks and tooling. It's a fast, pragmatic choice for server-rendered web apps and APIs — and runs a huge portion of the web.
Laravel or Symfony?
Laravel is batteries-included and optimized for developer velocity, ideal for most apps and rapid product work. Symfony is a set of composable components favored for large, enterprise, or highly-customized systems (and underpins parts of Laravel). Choose by how much structure vs. convention you want.
How do I make PHP fast?
Enable OPcache (and JIT where it helps), move slow work to background queues, cache expensive results in Redis/Memcached, and use a modern PHP version — each release has brought significant performance gains.
When should I not use PHP?
For CPU-heavy compute, real-time systems, or when your team and stack are centered elsewhere. PHP shines for server-rendered web apps, CMS-driven sites, and APIs; reach for Go/Rust for performance-critical services or Node for a shared-JS stack.
Related Topics
- SQL Injection — Why prepared statements matter
- Password Security —
password_hashand policies - REST API Design — Building PHP APIs
- Caching Strategies — Speeding up PHP apps
- Programming Languages — The broader landscape