This assessment covers the whole course. Answer each question on paper first, then open the answer. A score of 16 or more out of 20 means you are ready to build real projects.
1. What does echo "5" + "5" . "5"; print in PHP 8?
Show the answer
105. In PHP 8, + has higher precedence than ., so "5" + "5" is 10, then . joins "5": "10" . "5" is 105.
2. Which is safe against SQL injection: $pdo->query("... WHERE id = $id") or $pdo->prepare("... WHERE id = :id")?
Show the answer
The prepared statement with a placeholder. The value is sent separately from the SQL.
3. What is the result of var_dump(null ?? "default"); and var_dump(0 ?: "default");?
Show the answer
string(7) "default" for both. ?? falls back for null or missing. ?: falls back for any falsy value, and 0 is falsy.
<?php
var_dump(null ?? "default");
var_dump(0 ?: "default");string(7) "default"
string(7) "default"4. How do you make a property that can be set once and never changed?
Show the answer
public readonly string $name; (PHP 8.1), set in the constructor. Or put readonly on the whole class (PHP 8.2).
5. Complete the code so the output is [1, 4, 9].
<?php
$numbers = [1, 2, 3];
$squares = ____(fn($n) => $n * $n, $numbers);
echo json_encode($squares);Show the answer
array_map:
<?php
$numbers = [1, 2, 3];
$squares = array_map(fn($n) => $n * $n, $numbers);
echo json_encode($squares);[1,4,9]6. Why must you call session_regenerate_id(true) when a user logs in?
Show the answer
To prevent session fixation: an attacker who planted a known session ID before login cannot use it after the ID changes.
7. What is wrong with if ($user = getUser()) in a condition?
Show the answer
It assigns (=) instead of comparing. It is sometimes written on purpose (assign and test), but a typo for == or === is a classic bug. Write the assignment on its own line, so the intent is clear.
8. Write the output.
<?php
function f(array $a) { $a[] = 4; return count($a); }
$list = [1, 2, 3];
echo f($list) . " " . count($list);Show the answer
4 3. The array is passed by value, so the function changes only its own copy.
4 39. What does htmlspecialchars() protect against, and what does it not protect against?
Show the answer
It protects against XSS in HTML text and quoted attributes (with ENT_QUOTES). It does not protect SQL queries (use prepared statements), JavaScript contexts (use json_encode with JSON_HEX_* flags), or URLs (validate the scheme).
10. What does an interface contain, and how is it different from an abstract class?
Show the answer
An interface contains method signatures (and constants), no implementation or state. A class can implement many interfaces. An abstract class can contain code and properties, and a class extends only one.
11. How would you read JSON from a request body and handle bad JSON?
Show the answer
<?php
try {
$data = json_decode(file_get_contents("php://input"), true, 512, JSON_THROW_ON_ERROR);
} catch (JsonException) {
http_response_code(400);
exit(json_encode(["error" => "Invalid JSON"]));
}12. Which HTTP status do you return for: not logged in, logged in but not allowed, and not found?
Show the answer
401, 403 and 404.
13. What is the output?
<?php
enum Suit: string { case Hearts = "H"; case Spades = "S"; }
echo Suit::from("S")->name . " " . count(Suit::cases());Show the answer
Spades 2.
Spades 214. What is composer.lock for, and should you commit it?
Show the answer
It records the exact versions that were installed, so every install is identical. Commit it for applications. For libraries, usually not.
15. Why should a delete action be a POST request with a token, not a link?
Show the answer
A GET link can be triggered by crawlers, prefetching or an image tag on another site (CSRF). POST with a CSRF token proves the request came from your own form.
16. What is the N+1 query problem and the fix?
Show the answer
One query for a list plus one query per item. Fetch related data in one query with a JOIN, GROUP BY or WHERE id IN (...).
17. What does this print?
<?php
$a = ["x" => 1, "y" => 2];
[$first] = array_values($a);
["y" => $second] = $a;
echo "$first $second";Show the answer
1 2.
1 218. Name three places where secrets must NOT be stored.
Show the answer
In Git, inside the public web folder, and in client-side code (JavaScript or HTML). Also not in log files or error messages.
19. What is dependency injection, in one sentence?
Show the answer
Giving an object the things it needs (usually through its constructor) instead of letting it create them itself.
20. Write a function slug(string $title): string for “Hello, PHP World!” that returns hello-php-world.
Show a possible solution
<?php
function slug(string $title): string
{
return trim(preg_replace('/[^a-z0-9]+/', "-", strtolower($title)) ?? "", "-");
}
echo slug("Hello, PHP World!");hello-php-worldWhat you should now be able to do
- Write PHP with variables, conditions, loops, functions and arrays.
- Handle forms, validation, sessions and cookies.
- Read and write files, and handle uploads safely.
- Use exceptions and handle errors in production.
- Write object-oriented PHP with interfaces, traits and modern PHP 8 features.
- Organise code with namespaces and Composer.
- Work with MySQL using PDO and prepared statements.
- Build CRUD pages, login systems and JSON APIs.
- Recognise and prevent SQL injection, XSS, CSRF, session fixation and unsafe uploads.
- Structure a small PHP application, and read WordPress themes and plugins.
What to learn next
- Testing with PHPUnit or Pest.
- A framework: Laravel or Symfony.
- WordPress theme and plugin development.
- A deeper SQL and database design course.
- A JavaScript framework to build front ends for your APIs.
- Deployment: servers, Git, CI/CD and monitoring.