PHP Guide: Server-Side Web, Tutorials, OOP, and Frameworks

What PHP Actually Is

PHP is a server-side language for web pages, APIs, command-line tools, and database-backed applications.

What People Build with PHP

The web server hands each request to PHP. PHP builds the response and reads a database when the page needs stored records. The browser receives finished HTML or JSON.

Where PHP Came From

Early websites were static HTML files. Every changed date, product, or article meant editing and uploading another file. PHP added a server-side step that assembles the response from code and stored data.

Current PHP keeps that request-to-response model. Typed properties, enums, attributes, maintained 8.x releases, Composer autoloading, and PDO carry the modern surface.

What PHP Code Looks Like

One short example shows escaped output in a page heading.

<?php

$visitor = "Ada";

echo "<h1>Hello, " . htmlspecialchars(
    $visitor,
    ENT_QUOTES,
    "UTF-8",
) . "</h1>";

The example escapes a visitor name for HTML and prints a heading. The trailing comma after "UTF-8" has been allowed in function calls since PHP 7.3.

Save as .php and run php -S localhost:8000 in that folder for a local preview.

PHP at a Glance

Area	What it covers	Start here if
Language basics	Comparisons, conditionals, match, and loops	PHP is new to you and you want the syntax first
Databases	PDO, prepared statements, typed values, transactions	The application needs to store or read real data
Security	Input validation, output escaping, uploads, sessions	Anything you build will face the public internet
Configuration and hosting	php.ini, PHP-FPM pools, runtime overrides, the LAMP stack	The code works locally and now has to run on a server
Frameworks	Laravel, Symfony, Slim, CakePHP, and when plain PHP is enough	You are choosing what to build the next project on

Your State Does Not Survive the Request

Here is the rule the rest of PHP assumes you already know, and the one that surprises people arriving from JavaScript or Python. A request arrives, your script runs with a clean set of variables, a response goes out, and everything your code put in memory is discarded. The next request starts from nothing again.

That is why this does not do what a newcomer expects:

<?php

$visits = ($visits ?? 0) + 1;
echo "Visit number {$visits}";

It prints "Visit number 1" on every request, forever. The variable is not shared between visitors and it is not remembered between page loads by the same visitor. There is no long-running process holding it.

Anything that has to outlive a request must be deliberately stored somewhere that does: a session, a database row, a cache, a file. That single fact explains most of the surrounding machinery, starting with sessions, which exist precisely because variables do not persist.

Be careful about what "shared-nothing" actually covers, because the phrase is often stretched too far. What resets is your request state: variables, superglobals, and anything else your script created. The worker process underneath usually does not reset. Under PHP-FPM a pool of workers is reused across many requests, which is why compiled bytecode stays in OPcache between them and why a persistent database connection can be reused rather than dialled again. Settings in php.ini are read when the process starts, so changing one takes effect after an FPM reload rather than on the next page load.

The model still buys you something real. Because each request begins from a clean state, a bug that corrupts data in one request does not leave that mess sitting in memory for the next visitor to inherit, which is a class of problem long-running servers have to actively manage. The LAMP stack guide follows a single request the whole way through, which is the fastest way to make this concrete.

Why Old PHP Advice Is Dangerous

PHP has thirty years of tutorials online and search engines do not sort them by age. For most languages, stale advice is merely clumsy. For PHP a good deal of it is actively unsafe, so recognising the shapes matters more here than elsewhere.

The mysql_* functions. Any tutorial calling mysql_connect or mysql_query predates PHP 7, where that extension was removed outright. The code will not run at all on a supported version. Use PDO with prepared statements.

SQL assembled by string concatenation. This is the one that costs people real incidents:

// Do not do this. Anything in $_GET['id'] becomes part of the query.
$sql = "SELECT * FROM users WHERE id = " . $_GET['id'];

A prepared statement sends the query and the values separately, so a value can never be read as SQL. That distinction is the whole defence, and it is covered in the PDO guide above and in security fundamentals.

Advice about escaping input on the way in. Older guidance leans on addslashes, or on the magic_quotes and register_globals settings, both of which were removed in PHP 5.4. The current model is different in kind: validate input for shape, and escape at the point of output for the context it is going into. htmlspecialchars for HTML, prepared statements for SQL, and neither substitutes for the other.

Short open tags. Snippets beginning <? instead of <?php depend on the short_open_tag setting, which is disabled in both php.ini files PHP ships and on most hosts. Where it is off the code prints as plain text rather than running, so write <?php and do not rely on the short form being available.

The reliable test is the database call. If a snippet uses mysql_* or builds SQL by concatenation, it is old enough that everything else in it deserves checking too.

Core Concepts

• PHP conditionals and control flow covers strict comparisons, if, elseif, switch, match, and loops.
• Object-oriented PHP introduces classes, constructors, repositories, interfaces, and the cost of deep inheritance.
• PHP configuration explains php.ini, scanned files, PHP-FPM pools, and narrow runtime overrides.
• PHP and MySQL with PDO covers prepared statements, typed values, connection errors, and transactions.
• PHP security fundamentals connects input validation, output escaping, file uploads, sessions, and deployment settings.
• PHP frameworks compared explains when Laravel, Symfony, Slim, CakePHP, Fat-Free Framework, or plain PHP fits the application.

The service-counter model stays useful across these topics. Control flow decides which route the request takes, configuration controls the PHP process behind the counter, PDO reaches the database, and security rules decide which values may cross each boundary.

Popular How-tos

The full hands-on collection lives on the PHP tutorials page: project builds, task walkthroughs, and the security references, grouped by subject. The most-used entries:

Forms, Input, and Email

Almost every PHP application starts here: something arrives from a user, gets checked, and triggers a message.

• Validate email addresses in PHP: the checks worth running server-side before an address is stored or mailed.
• Validate form input and spelling in PHP: checking what users typed beyond the format level.
• Send email from a PHP application: text and HTML mail with attachments, sent safely.
• Send SMS from PHP with an HTTP provider API: reaching phones through a gateway when email is not enough.

Working with Data and Files

The database walkthroughs build on the PDO guide; the file and XML pieces need only core PHP.

• Add search to a PHP and MySQL app: LIKE queries, relevance, and result pages.
• Add news posts and comments with PHP and MySQL: one-to-many data in a real page.
• Build PHP pagination with previous and next links: slicing large result sets into pages users can walk.
• Read and write text files with PHP: reading, writing, and appending without corrupting data.
• Process XML with PHP: parsing feeds and structured documents.
• Use recursion for tree-shaped PHP data: the technique behind directory walkers and nested menus.

Images, Media, and the Browser

PHP renders more than HTML: with GD it manipulates images, and with the right headers it controls how files and pages reach the browser.

• Create image thumbnails with PHP and GD: a directory thumbnail system, resized server-side.
• Composite images with PHP and GD: layering and overlapping images before they are served.
• Authorize protected media downloads with PHP: serving audio through PHP instead of direct file links.
• Add controlled browser polling to a PHP page: refreshing only when the data actually changed.

APIs and Lower-Level Plumbing

Where PHP talks to other programs rather than people.

• Build a JSON API with PHP: exposing your application's data for other clients to consume.
• Write a small PHP template system: separating markup from logic by hand, which is what every template engine automates.
• Use sockets and streams in PHP: talking to other servers below the HTTP layer.

Longer Guides

• The LAMP stack explained follows a request through Linux, Apache, MySQL, and PHP, then shows how PHP-FPM and containers change the deployment.
• Build a small PHP database app connects routing, validation, PDO, views, and database writes without hiding the request lifecycle.
• PHP authentication and sessions covers password hashing, session rotation, secure cookies, CSRF protection, and authorization boundaries.
• Build a mini chat app with PHP combines sessions, PDO, escaped output, CSRF protection, and polling in one project.

What PHP Cannot Do

PHP runs on the server, so it cannot touch the page after it has been sent. Clicking, dragging, validating a field as someone types, or updating part of a view without a reload all belong to JavaScript in the browser. A PHP application that feels interactive is a PHP application paired with JavaScript, not one doing it alone.

A web request also cannot keep work running after it responds. A scheduled job, a queue worker, or a background task belongs outside the request: cron, a CLI worker, or a queue service. Note the boundary is the web request rather than the language, since PHP on the command line runs long-lived processes perfectly well and that is exactly how those workers are written. Reaching for a long-running loop inside a web request is the usual early mistake, and it ties up a PHP-FPM worker that other visitors are waiting on.

Browser-side validation is the third boundary worth naming, because it looks like a feature and is not a defence. Anyone can send a request that never touched your form. Validation you rely on happens in PHP, which is why application security treats the browser as untrusted input rather than a first line.

Related SQL Guides

• Start with the SQL tutorials hub when the application stores relational data.
• Use SQL joins when one PHP response needs related rows from several tables.
• Read SQL transactions and ACID before one request writes several related records.
• Review schema design basics when PHP code keeps repairing missing or duplicated relationships.

Frequently Asked Questions

Is PHP still supported?

Yes. PHP 8.3 through 8.5 receive support as of August 2026, although 8.3 is security-fixes only. PHP 8.2 reached end of life in December 2025 and should not be used for new work. Each release gets about two years of active support and one further year of security fixes.

Is PHP compiled or interpreted?

Interpreted, in the sense that there is no build step to run. Internally the Zend Engine compiles source to bytecode before executing it, and OPcache keeps that compiled form between requests, which is where much of PHP's modern speed comes from.

What does Composer do?

Composer records PHP package requirements and generates an autoloader for project classes and installed packages. It replaces chains of manual require statements with one declared dependency and namespace boundary. A project can still be small while using Composer for predictable loading.

How does PHP reach a database?

PHP commonly reaches relational databases through PDO or a framework database layer built above it. Use prepared statements to keep application values separate from SQL text, bind values with the correct types, and place multi-step writes inside a transaction when they must succeed together.

Can PHP run without Apache or Nginx?

Yes. PHP has a built-in development server started with php -S, which is fine for local work and useless for production. It also runs as a command-line language for scripts, cron jobs, and build tooling with no web server involved.

What is PHP-FPM?

The FastCGI Process Manager, which keeps a pool of PHP worker processes ready and hands requests to them. It is how PHP is normally run behind Nginx, and it is where you tune how many concurrent requests a server will accept.

How does PHP compare with JavaScript for web work?

PHP runs on the server only, while JavaScript runs in the browser and, through Node, on the server too. A PHP application still needs JavaScript for anything interactive in the page, so the two are usually paired rather than compared.

Where to Start

Build one page that reads from a database and one form that writes to it, and do both with PDO and prepared statements from the first line rather than adding them later. That single exercise exercises the request lifecycle, input validation, output escaping, and the database boundary at once, which is most of what PHP asks you to hold in your head. Work through control flow if the syntax is new, then PDO with MySQL, then security fundamentals before anything you write goes near the public internet. The small database app guide assembles the same pieces end to end if you would rather follow a worked build.