PHP Trainer

What PHP is, where it came from and — more usefully — what actually happens between a browser request and a rendered page. The interpreter, the share-nothing model, how PHP is served under Apache and under Nginx with PHP-FPM, and the reserved words and data types you will meet on the first day.

Topics: Intended audience and what PHP is good at · History of PHP and what changed at 7 and 8 · What's possible: the range of PHP workloads · Sample programs and running scripts from CLI and web · Reserved keywords · General data types and type juggling · The request lifecycle under Apache and PHP-FPM · php.ini, error reporting and a sane development configuration

• Assignments: (1) Set up a working PHP environment and serve a script through both CLI and a web server; (2) Demonstrate three type-coercion surprises and explain each
• Capstone: Build a documented local development environment you keep for the rest of the course

The building blocks, including the operators people get wrong. Loose versus strict comparison, the spaceship operator for sorting, the null coalescing operator and its assignment form, and the full set of control structures — with attention to where a switch is the wrong tool and match is the right one.

Topics: Arithmetic operators · Incrementing and decrementing operators · Assignment operators · String operator and concatenation · Comparison operators and loose vs strict equality · Spaceship operator · Logical operators · If statement and else if · Switch statement and the match expression · Ternary operator · Null coalesce operator and ??= · While loop · For loop and foreach

• Assignments: (1) Fix a set of bugs caused by loose comparison; (2) Rewrite a nested if chain as a match expression
• Capstone: Produce a short internal style guide covering comparison and control-flow conventions

How PHP functions behave and where variables actually live. Declaration, arguments, defaults and returns; the difference between passing by value and by reference; variable scope and why globals cause the bugs they do. Then the modern additions: type declarations, named arguments, variadics, closures and arrow functions.

Topics: What is a function and when to write one · Creating and calling a function · Passing parameters and passing by reference · Default parameters and named arguments · Returning values and return types · Variable functions and callables · Variable scope · Global variables and why to avoid them · Closures, use, and arrow functions · Variadics and argument unpacking

• Assignments: (1) Refactor a script full of globals into functions with explicit parameters; (2) Write a higher-order function that accepts and returns a callable
• Capstone: Extract a reusable, fully typed function library from a procedural script

String handling in a language where strings are where most output — and most vulnerabilities — live. Quoting rules and interpolation, heredoc and nowdoc, the core string functions, and multibyte handling for anything that is not plain ASCII. Formatting with sprintf, and why concatenating user input into output is where XSS begins.

Topics: Single quoted strings · Double quoted strings and interpolation · Here document and nowdoc · print, echo and output buffering · Changing case · strlen and multibyte length · strpos and searching · str_replace · substr · str_split and explode · sprintf and number formatting · Multibyte and encoding considerations

• Assignments: (1) Build a text-processing utility using only core string functions; (2) Break a naive string routine with multibyte input, then fix it
• Capstone: Write a safe output-formatting helper with escaping built in by default

PHP's most-used and most-abused data structure. Indexed, associative and multidimensional arrays; the search, mutation and sorting functions; and the functional trio — array_map, array_filter and array_reduce — that replaces most hand-written loops. Then when an array has outgrown its usefulness and should become an object.

Topics: Overview: what a PHP array really is · Indexed arrays · Associative arrays · array_key_exists · in_array and array_search · array_push and array_pop · unset and reindexing · Sorting arrays: sort, usort, ksort and friends · count · Foreach loop and references in loops · Multi-dimensional arrays · array_map, array_filter and array_reduce · Spread operator and array unpacking · When to replace an array with a class

• Assignments: (1) Transform a nested dataset using only array functions, no loops; (2) Take an array-shaped record and convert it to a typed object
• Capstone: Build a small in-memory data-processing pipeline over a realistic dataset

The object model everything modern in PHP is built on. Classes, objects, properties, constants and methods; $this and scope resolution; constructors and constructor property promotion; inheritance and visibility. Then the parts that make composition possible — interfaces, abstract classes, traits — and the PHP 8 additions: enums, readonly properties and attributes.

Topics: Creating a simple class and creating an object · Creating and accessing properties · Creating and accessing constants · Creating and accessing methods · $this and object context · Constructors and initial parameter passing · Constructor property promotion · Inheritance · Protected properties · Private properties · Static properties and methods · Scope resolution operator and late static binding · Interfaces and abstract classes · Traits · Enums and readonly properties · Magic methods and when to avoid them · include and require and why autoloading replaced them

• Assignments: (1) Model a small domain with interfaces and at least two implementations; (2) Replace an array-of-arrays structure with typed value objects
• Capstone: Design and implement a small, fully typed domain model with tests for its invariants

How a PHP project becomes a project rather than a folder. Composer for dependencies, PSR-4 autoloading and namespaces for structure, semantic versioning and lock files. Then the error and exception model: the Error and Exception hierarchy, custom exceptions, try/catch/finally, and a global handler that logs rather than leaks.

Topics: Composer: require, install, update and the lock file · Semantic versioning and constraint syntax · PSR-4 autoloading and directory layout · Namespaces, use statements and aliasing · PSR-12 coding style and automated formatting · The Throwable, Error and Exception hierarchy · try, catch, finally and multi-catch · Custom exception classes · Global error and exception handlers · Logging with PSR-3 and Monolog

• Assignments: (1) Convert an include-based project to Composer with PSR-4 autoloading; (2) Replace error-code returns with a typed exception hierarchy
• Capstone: Restructure a legacy script directory into a Composer package with namespaces and logging

Talking to a database without opening a hole. The database options PHP supports, the honest comparison of PDO and MySQLi, and connection handling and lifecycle. Then prepared statements as the default for every query with a variable in it, fetch modes, transactions, and stored procedures — with the lending-library project as a running example through create, read, update and delete.

Topics: Possible databases and drivers · PDO vs MySQLi · Setting up MySQL and creating a database and table · Connecting to a database and closing the connection · Designing and populating a schema · Executing a query: insert, update, delete · Grabbing the inserted id · Selecting data from the database · Prepared statements and bound parameters · Fetch modes and hydrating objects · Quoting and input validation at the database boundary · Transactions and error modes · Stored procedures and functions · Non-queries and summary functions · Connection pooling realities under PHP-FPM

• Assignments: (1) Build a full CRUD data-access layer using only prepared statements; (2) Wrap a multi-step write in a transaction and prove rollback on failure
• Capstone: Deliver the lending-library data layer: schema, repository classes, transactions and tests

The request and response side. Site layout and a single front controller, superglobals and what they really contain, form handling and validation, file uploads, and the three ways to maintain state across a stateless protocol — sessions, cookies and hidden fields — with the trade-offs of each. Built out through the shopping-cart and user-preferences examples.

Topics: Setting up site location on Linux and Windows · Website structure, layout and the front controller pattern · Short syntax and separating templates from logic · $_GET and $_POST · Accessing form data with PHP and HTML forms · Form validation and input filtering · File uploads and $_FILES · session_start, $_SESSION and session_destroy · Session configuration, lifetime and storage · Using cookies · Using hidden fields · Building the LAMP stack: installation and alternatives · User preferences and shopping carts · Redirects, headers and the post/redirect/get pattern

• Assignments: (1) Build a validated multi-step form that survives a page refresh correctly; (2) Implement a session-backed cart with server-side price authority
• Capstone: Ship a small database-backed web application with forms, sessions and a clean front controller

The failures PHP is historically known for, and exactly how each one is closed. Injection prevented by prepared statements rather than escaping; XSS prevented by context-correct output encoding; CSRF prevented by tokens; sessions hardened against fixation and hijacking; passwords hashed with password_hash rather than anything invented in-house; uploads and configuration handled so they cannot be turned into a foothold.

Topics: SQL injection and why prepared statements are the fix · Cross-site scripting and context-aware output escaping · CSRF tokens and same-site cookies · Session fixation, regeneration and secure session cookies · password_hash, password_verify and rehashing · filter_var and validating rather than sanitising · File upload safety: type, size, storage location and execution · Secrets and configuration outside the web root · Error output, stack traces and information disclosure · Dependency vulnerabilities and composer audit

• Assignments: (1) Attack a deliberately vulnerable page in the lab, then fix it properly; (2) Add CSRF protection and secure session handling to an existing form
• Capstone: Produce a security review of an application with findings, fixes and a regression test for each

The last mile. Serving JSON over HTTP — resource design, status codes, content negotiation, CORS and testing endpoints with Postman. Then quality: PHPUnit for behaviour, PHPStan or Psalm for correctness before runtime. Finally production: PHP-FPM pool sizing, OPcache, profiling a slow request with Xdebug, and deployment.

Topics: What RESTful services are and how PHP serves them · Course structure for the API project and demo overview · Routing JSON endpoints through a front controller · Status codes, content negotiation and error payloads · Cross-origin resource sharing (CORS) · Postman setup and testing endpoints · Refresher on RESTful services and where a framework takes over · PHPUnit: unit tests, fixtures and data providers · Static analysis with PHPStan or Psalm · PHP-FPM pool tuning and process management · OPcache configuration and preloading · Profiling with Xdebug and finding the slow query · Deployment, environment configuration and wrap up

• Assignments: (1) Build and test a JSON API for the lending-library data layer; (2) Raise a codebase to a clean static-analysis baseline and keep it there in CI
• Capstone: Deliver a tested, analysed, profiled API with a documented deployment and tuning configuration