PHP Fundamentals

🎯Learning Objectives

Level 20 traced requests through a backend. PHP provides a concrete language for writing that side of an application. This lesson introduces its syntax, values, arrays, functions and form-processing boundaries, then follows a small study-plan quote from submitted strings to escaped HTML output.

Write clear PHP blocks, distinguish strings from accepted numbers, validate a form independently of browser controls and explain what PHP sends back to a browser. The interactive lab demonstrates a fixed algorithm in JavaScript; the matching PHP source can run separately in a PHP-enabled environment.

🖥️PHP Executes in a Supported Runtime

A PHP interpreter evaluates PHP source. In a web application, the runtime handles a request and produces output such as HTML or JSON. The browser receives the response; it does not execute the server’s PHP source as browser JavaScript.

Saving a file with a .php extension is not enough. A host must be configured to execute PHP, or a separate backend must provide it. Uploading a PHP file into a static frontend folder does not add that runtime. Keep source and private configuration from being served as public text.

For learning, PHP also has a command-line interface. You can run a script directly, check its syntax and use the built-in development server. That development server is intended for local development, not as a public production hosting solution.

php -v
php -l study-plan.php
php tests.php
php -S 127.0.0.1:8000
# Run these in the folder containing the example files.

With PHP installed, open http://127.0.0.1:8000/study-plan.php after starting the local server. The downloadable patch contains the example separately from the website upload files. It does not require changing your existing frontend hosting.

🏷️PHP Tags, Statements and Comments

The standard opening tag is <?php. PHP statements commonly end with a semicolon, while braces delimit blocks such as functions and conditionals. Comments explain a decision without becoming output.

A PHP file can contain HTML outside PHP blocks, which the runtime sends as output. A file containing only PHP commonly omits the closing tag to avoid accidental trailing output. Headers must be sent before response body output.

Use full opening tags rather than relying on a short-tag configuration. In the examples, the opening tag, variable assignments and echo statements belong to PHP source; the values emitted by echo belong to the response.

<?php
// A complete CLI greeting script.
$course = "PHP";
echo "Learning " . $course . "
";
// No closing tag is needed in this PHP-only file.

Do not confuse a syntax error with a failed form validation. The interpreter must first understand the program. A missing semicolon or unmatched brace can prevent the intended handler from running at all.

💲Variables, Types and Strict Comparisons

PHP variables begin with a dollar sign. Names are case-sensitive, so $course and $Course are different variables. An ordinary assignment stores a value; types include integers, floating-point values, strings, booleans, arrays and null.

The strict comparison operators === and !== consider type as well as value. Form values arrive as strings in the ordinary scalar form case, so the string "2" is not the same typed value as the integer 2. Validate the submitted representation before converting it.

Declare(strict_types=1) affects scalar type declarations at call boundaries; it does not automatically validate HTTP input or change every operator into a strict operator. A cast can produce a number from an unacceptable string, so casting alone is not the form contract.

<?php
$submitted = "2";
var_dump($submitted === 2);  // false
$acceptedDays = (int) $submitted; // after validation
var_dump($acceptedDays === 2); // true
$enabled = true;
$missing = null;

Use strict comparisons where type matters. Avoid depending on loose equality to decide whether an external field is valid, and do not use a successful cast as proof that the original input was acceptable.

🔤Strings, Concatenation and Output

PHP uses the dot operator for string concatenation. Echo emits output, while returning a value from a function makes it available to its caller. A function can calculate a value without immediately sending anything to the browser.

Double-quoted strings can interpolate variables; single-quoted strings have more limited interpretation. Choose whichever makes the intended text clear. The plus operator is for arithmetic, not PHP string concatenation.

A PHP string is a sequence of bytes. Strlen measures bytes, not a universal count of visible letters. Our form example uses a UTF-8 regular expression to bound Unicode code points and rejects ASCII control characters; it does not claim to count user-perceived grapheme clusters.

<?php
$topic = "Forms";
echo "Study " . $topic;
echo "
Topic: $topic
";
echo 'Literal variable name: $topic';

In a web page, raw echo of untrusted text can create HTML markup. Calculating a correct string and inserting it into the correct output context are separate responsibilities. The escaping section shows how this lesson handles HTML text.

🧮Operators and Bounded Integer Calculations

Arithmetic operators include +, -, *, / and %. Conditions use comparisons and logical operators. Keep a calculation’s units clear: duration in days, unit price in paise and total price in paise are different values.

Our fictional quote uses integer paise: HTML 12550, CSS 15000 and PHP 18000 per day. Days is an accepted integer from 1 to 5. Multiplication produces totalPaise; integer division and a two-digit remainder format the displayed rupees.

This bounded exercise avoids introducing a floating-point rounding decision into the price calculation. It is not a payment system or a general tax, currency-conversion or financial rounding engine.

<?php
$unitPaise = 12550;
$days = 2;
$totalPaise = $unitPaise * $days; // 25100
$totalINR = (string) intdiv($totalPaise, 100) . "." .
    str_pad((string) ($totalPaise % 100), 2, "0", STR_PAD_LEFT);
echo $totalINR; // 251.00

Check the accepted bounds before calculation. If your application later supports arbitrary prices or very large quantities, review integer range, input rules and formatting again instead of assuming this small contract covers every case.

🔀Conditions and Loops

If/elseif/else selects a branch. An early return can stop a handler after a rejected method or invalid input. That makes it easier to see why a failure never reaches the calculation.

For and foreach repeat work. Foreach is convenient for traversing an array of course records or a list of validation errors. Keep output escaping inside the rendering step rather than assuming array values are safe.

The PHP example gathers independent name, course and day errors after confirming that all three fields are scalar strings. A missing or array-valued field is rejected earlier because later string functions should not be called on it.

<?php
$errors = ["Choose a course", "Choose 1-5 days"];
foreach ($errors as $error) {
    echo htmlspecialchars($error, ENT_QUOTES | ENT_SUBSTITUTE, "UTF-8");
    echo "
";
}
for ($day = 1; $day <= 5; $day++) {
    echo $day . " ";
}

A loop in a request handler completes its work for that request. It does not keep a browser form connected to a changing server variable after the response is finished. A later interaction requires another request or an explicitly implemented connection.

🗂️Arrays — Indexed and Associative Data

PHP arrays map keys to values and preserve order. An indexed collection can hold error messages; an associative array can hold named fields such as title and unitPaise. Nested arrays represent small records or tables.

The example course table uses fixed keys html, css and php. The submitted course must match one of those keys before its price is read. Do not create a new trusted course record from arbitrary client-supplied price data.

Array access and null coalescing help handle absent values, but a default does not prove input validity. Confirm whether a field exists and whether its value has the expected type before using it.

<?php
$courses = [
    "html" => ["title" => "HTML", "unitPaise" => 12550],
    "css" => ["title" => "CSS", "unitPaise" => 15000]
];
$selected = "html";
if (array_key_exists($selected, $courses)) {
    echo $courses[$selected]["title"];
}

Our exact form contract rejects extra fields. A browser-supplied role or price therefore does not silently become part of the accepted record. For a real application, document which fields are accepted and which are derived from server data.

🧩Functions Separate Processing from Rendering

A function can validate a record, calculate a result or escape text. Clear parameters and return values make the pieces easier to inspect and test. Keep a pure calculation separate from the code that sends headers or renders a page.

ProcessPlan in the example receives already decoded form fields, a method and a media type. It returns a structured result containing status, headers and a body. PlanHtml turns that accepted result into an escaped HTML fragment.

The dispatch block reads $_POST and $_SERVER, invokes the processor, sends response metadata and outputs a small page. CLI tests can call the processor without pretending that an HTTP request or browser session exists.

<?php
function totalPaise(int $unitPaise, int $days): int
{
    return $unitPaise * $days;
}
$amount = totalPaise(12550, 2);
echo $amount; // 25100

Type declarations improve the function interface; they do not replace the processor’s validation of external values. In the form flow, a string is converted to an integer only after its allowed spelling has been accepted.

📨GET, POST and PHP Superglobals

Superglobals are predefined arrays available in different scopes. $_GET represents URL query input. $_POST normally contains decoded form data for URL-encoded or multipart POST bodies. $_SERVER provides request and execution information, including the request method in a web environment.

A JSON request body does not automatically become the same $_POST form array. A JSON handler would read the raw body through php://input, decode it and validate its own contract. This example deliberately accepts only application/x-www-form-urlencoded.

Scalar form controls usually produce strings, but bracketed field names can produce arrays. A crafted days[] input is not the expected scalar duration. The processor checks is_string before applying a regular expression or cast.

<?php
$method = $_SERVER["REQUEST_METHOD"] ?? "GET";
if ($method === "POST") {
    $days = $_POST["days"] ?? null;
    if (!is_string($days)) {
        // Reject missing or array-valued input before conversion.
    }
}

The browser lab shows a simulated already decoded field object. It is not a PHP request parser and does not model duplicate parameter normalization or every possible field-name transformation. The separate PHP runtime handles actual form decoding.

✅Validate Before Normalizing a Study Plan

The exact decoded record is learner, course and days. All three must be strings. Learner is trimmed with PHP’s default trim character set, then must contain 2–40 Unicode code points with no ASCII control characters. Course must be html, css or php. Days must be exactly one digit from 1 to 5.

Only learner is trimmed. Days "02", "+2", "2.0", "2e0" and " 2 " are rejected even if a cast could produce an integer. Once the representation is accepted, convert days to an integer and derive the price from the fixed course table.

Validation and normalization are deliberate application rules. This short learner label is a demonstration field, not a universal policy for personal names. Unicode code points and visible characters can differ when combining marks or joined emoji are used.

Failed validation returns 400 without calculating a quote. GET returns a ready form; unsupported methods return 405 with Allow: GET, POST; an unsupported POST media type returns 415. A successful quote uses 200 because nothing is booked, paid or stored.

🛡️Escape Values for HTML Output

Htmlspecialchars encodes special HTML characters. The example explicitly uses ENT_QUOTES | ENT_SUBSTITUTE and UTF-8 when placing a learner label into HTML text. An accepted label such as Ada <b> should be displayed literally rather than creating a bold element.

Escaping does not establish that a value meets the input contract. Conversely, validating a name’s length does not make it safe to insert as HTML. Validate at the input boundary and encode for the output context.

HTML text escaping is not SQL protection, JavaScript string encoding or URL validation. Use parameterized queries for database values and the relevant rules for other destinations. The study-plan example has no database and never evaluates submitted PHP code.

<?php
$learner = "Ada <b>";
echo "<p>" . htmlspecialchars(
    $learner, ENT_QUOTES | ENT_SUBSTITUTE, "UTF-8"
) . "</p>";
// Source: <p>Ada &lt;b&gt;</p>
// Visible text: Ada <b>

The browser lab displays both an escaped-source representation and a safe preview built with DOM text nodes. It does not insert user-provided HTML or execute PHP. Seeing the source and visible text together makes the encoding boundary easier to inspect.

🧭Trace the Form-to-Response Lifecycle

A normal form submission encodes its successful controls, sends the selected method to the action URL and receives a response. PHP interprets the script on the server, reads the appropriate input arrays and produces the response.

Our example checks method and media type before the form record. It verifies shape and scalar types, validates fields, calculates the quote and renders escaped output. A rejected request stops before calculation; the response makes the failed stage visible.

PHP variables in this handler belong to the current execution. They do not create durable records between independent requests. Sessions or a database need their own design and lifecycle, as introduced in Level 20.

The lab demonstrates this fixed flow locally. The real PHP example receives an actual form when run in a configured PHP environment. Neither version collects a payment, makes a reservation or saves the submitted label.

🛠️Errors, Headers and Practical Boundaries

Keep syntax errors, invalid submissions and operational failures separate. A syntax check helps catch malformed source. Validation responses help a learner correct an input. A deployed server needs private diagnostic logging and deliberate handling of unexpected failures.

Header calls and http_response_code belong before body output. A stray byte before the PHP opening tag or unexpected output from an included file can cause a headers-already-sent problem. Separating processing from output helps keep this order clear.

Browser restrictions, request-size limits and runtime configuration still matter. A production handler should bound request bytes before parsing, use an appropriate session and permission design for protected operations, and keep secrets out of public frontend files.

The demonstration quote does not change server data and is not an authentication system. It intentionally leaves persistence, payments and protected application actions for separately implemented features.

💻Complete PHP Example — A Small Study-Plan Handler

Save the following complete source as study-plan.php in a local PHP example folder. It includes reusable processing/rendering functions and a web dispatch block. The supplied tests.php calls those functions from the command line; PHP CLI execution skips the web output block.

Run php -l study-plan.php and php tests.php, then start php -S 127.0.0.1:8000 in that folder and open /study-plan.php. The example belongs in a PHP-enabled environment; keep it separate from the frontend upload patch.

The code is supplied for inspection and local execution. The browser exercise below is a JavaScript demonstration of its documented algorithm, not a general PHP interpreter.

<?php
declare(strict_types=1);

function planEscape(string $text): string
{
    return htmlspecialchars($text, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
}

function processPlan(array $post, string $method, string $mediaType): array
{
    $headers = ['Content-Type' => 'text/html; charset=UTF-8'];
    if ($method === 'GET') {
        return ['status' => 200, 'headers' => $headers,
            'body' => ['message' => 'Form ready. Submit a fictional study plan.']];
    }
    if ($method !== 'POST') {
        $headers['Allow'] = 'GET, POST';
        return ['status' => 405, 'headers' => $headers,
            'body' => ['message' => 'Only GET and POST are supported.']];
    }
    $media = strtolower(trim(explode(';', $mediaType)[0]));
    if ($media !== 'application/x-www-form-urlencoded') {
        return ['status' => 415, 'headers' => $headers,
            'body' => ['message' => 'This example accepts URL-encoded form data.']];
    }
    $keys = array_keys($post);
    sort($keys);
    if ($keys !== ['course', 'days', 'learner']) {
        return ['status' => 400, 'headers' => $headers,
            'body' => ['message' => 'Expected exactly learner, course and days.']];
    }
    foreach (['learner', 'course', 'days'] as $key) {
        if (!is_string($post[$key])) {
            return ['status' => 400, 'headers' => $headers,
                'body' => ['message' => 'Each submitted field must be a string.']];
        }
    }
    $learner = trim($post['learner']);
    $errors = [];
    if (preg_match('/\A.{2,40}\z/u', $learner) !== 1 ||
        preg_match('/[\x00-\x1F\x7F]/', $learner) === 1) {
        $errors[] = 'Learner must contain 2-40 Unicode code points after trim, with no ASCII control characters.';
    }
    $courses = [
        'html' => ['title' => 'HTML', 'unitPaise' => 12550],
        'css' => ['title' => 'CSS', 'unitPaise' => 15000],
        'php' => ['title' => 'PHP', 'unitPaise' => 18000]
    ];
    if (!array_key_exists($post['course'], $courses)) {
        $errors[] = 'Course must be html, css or php.';
    }
    if (preg_match('/\A[1-5]\z/', $post['days']) !== 1) {
        $errors[] = 'Days must be exactly one digit from 1 to 5.';
    }
    if ($errors !== []) {
        return ['status' => 400, 'headers' => $headers,
            'body' => ['message' => 'Form validation failed.', 'errors' => $errors]];
    }
    $days = (int) $post['days'];
    $course = $courses[$post['course']];
    $totalPaise = $course['unitPaise'] * $days;
    $totalINR = (string) intdiv($totalPaise, 100) . '.' .
        str_pad((string) ($totalPaise % 100), 2, '0', STR_PAD_LEFT);
    return ['status' => 200, 'headers' => $headers, 'body' => [
        'message' => 'Study quote calculated; nothing was booked or saved.',
        'accepted' => ['learner' => $learner, 'course' => $course['title'],
            'days' => $days, 'unitPaise' => $course['unitPaise'],
            'totalPaise' => $totalPaise, 'totalINR' => $totalINR]
    ]];
}

function planHtml(array $result): string
{
    $body = $result['body'];
    if (!isset($body['accepted'])) {
        $html = '<p>' . planEscape($body['message']) . '</p>';
        foreach ($body['errors'] ?? [] as $error) {
            $html .= '<p>' . planEscape($error) . '</p>';
        }
        return $html;
    }
    $plan = $body['accepted'];
    return '<h2>Study quote</h2><p>Learner: ' . planEscape($plan['learner']) .
        '</p><p>Course: ' . planEscape($plan['course']) .
        '</p><p>Days: ' . (string) $plan['days'] .
        '</p><p>Total: INR ' . planEscape($plan['totalINR']) . '</p>';
}

// PHP's CLI web server reports "cli-server" here; CLI tests report "cli".
if (PHP_SAPI !== 'cli') {
    $method = $_SERVER['REQUEST_METHOD'] ?? 'GET';
    $media = $_SERVER['CONTENT_TYPE'] ?? '';
    $result = processPlan($_POST, $method, $media);
    http_response_code($result['status']);
    foreach ($result['headers'] as $name => $value) {
        header($name . ': ' . $value);
    }
    echo '<!doctype html><html lang="en"><meta charset="UTF-8">';
    echo '<meta name="viewport" content="width=device-width, initial-scale=1">';
    echo '<title>PHP study-plan example</title><body><h1>Study-plan form</h1>';
    echo '<p>Learning example only. No payment, reservation or storage.</p>';
    echo planHtml($result);
    echo '<form action="study-plan.php" method="post">';
    echo '<p><label>Learner <input name="learner" required></label></p>';
    echo '<p><label>Course <select name="course"><option value="html">HTML</option>';
    echo '<option value="css">CSS</option><option value="php">PHP</option></select></label></p>';
    echo '<p><label>Days <select name="days">';
    for ($day = 1; $day <= 5; $day++) {
        echo '<option value="' . $day . '">' . $day . '</option>';
    }
    echo '</select></label></p><button type="submit">Calculate quote</button></form>';
    echo '</body></html>';
}

🧪Premium Interactive — Study-Plan Form Demonstration

This browser lab is implemented in JavaScript and mirrors the documented form algorithm. It does not execute arbitrary PHP, send a request or save a learner label. The complete PHP source above can be run separately in a PHP environment.

The initial plan is Ada, HTML and the submitted string "2". A valid quote is INR 251.00. HTML costs 12550 paise per day, CSS 15000 and PHP 18000. Days must be exactly one digit 1–5; learner is trimmed and checked as described above.

Inspect the simulated decoded form input, stage trace, normalized result and escaped HTML source. The safe preview uses text nodes. Try a missing field, array-valued duration or an extra client price: each must reject before calculation. GET displays a ready message and ignores the form fields.

No input processed.

No trace yet.

No result yet.

No generated source yet.

🛠️Debugging — Separate Syntax, Input and Output

If JSON data appears absent from $_POST, inspect the request media type and the handler’s parsing contract. If days[] produces a type problem, reject non-string values before applying trim, regular expressions or integer conversion.

If a label appears as markup, inspect the rendering boundary. The HTML source should contain entities while the visible preview should contain the original literal text. If the quote changes after adding a price field, the handler is trusting a field outside its contract.

Use the local PHP syntax check and supplied test script before trying the real form. JavaScript tests of the browser demonstration cannot prove that a PHP runtime, its input decoding or headers behave correctly.

💬Interview Questions — Flip to Explain

❓MCQ Practice — Read the PHP Form Contract

💻Extra Practice — Predict the Form Result

📌Quick Revision

📖Glossary — Flip to Learn

🏆Final Challenge — Implement and Inspect a PHP Form

Run the supplied study-plan.php in a local PHP environment. Keep the exact scalar field contract and trusted course table. Validate method, media type, shape and values before converting days or calculating a quote. Escape the accepted learner label when generating HTML text.

Reproduce the valid quote, invalid days spellings, wrong-shaped fields and literal markup case. Compare the browser demonstration with PHP execution without assuming that one test proves the other runtime. Add real-request checks for GET, POST and an unsupported method.

Explain the differences between returned values and emitted output, scalar strings and integers, validation and escaping, and a calculated quote and a persistent booking. Keep the example separate from the static frontend deployment.

Success criterion: trace accepted external strings into a deliberate PHP response and explain each rejected boundary. Level 22 introduces Java Web Technologies.