PHP Guide: Server-Side Web, Tutorials, OOP, and Frameworks

PHP is the language behind WordPress, Laravel, and a large share of the working web. This page introduces everything under it for someone who has never run a PHP script and wants to know whether to start, what to build, and which guide to open first.

Each section answers one question a newcomer asks before committing: whether the language is worth the time, who uses it, how it compares with Node, whether it is secure, and how coding agents change the work. The tutorials and reference guides follow as a roadmap.

What Is PHP, in Plain Words?

PHP is a programming language that runs on a web server and builds a page each time a visitor asks for one. The PHP manual describes it as a widely used open source scripting language that is especially suited to web development. The browser sends a request, the server hands it to PHP, PHP runs your code, and the browser receives the finished HTML or JSON that comes back.

A request is one visit to one address, such as a page load or an API call. A server-side language is one that runs on the machine hosting the site and never inside the visitor's browser. A framework is a bundle of ready-made code, such as Laravel, that handles the repeated parts of an application so each project starts further along.

Whenever a page needs stored records, PHP reads a database, which is why the language is usually mentioned beside MySQL or MariaDB. The language is free to use, and its source repository states that PHP is distributed under the Modified BSD License. That matters to anyone who prefers to read what they run.

Is PHP Still Worth Learning in 2026?

Yes, for a specific list of jobs, and the survey numbers explain why the answer is calm rather than excited. The Stack Overflow Developer Survey put PHP at 18.58 percent of all respondents in 2023, 18.2 percent in 2024, and 18.9 percent in 2025. A flat line over three years describes a language that is neither growing nor fading. PHP is the steady option in that survey, while Python gained about seven points in the same year.

The language itself is actively maintained by a funded group of contributors. The PHP Foundation, a collective of people and organisations that rely on PHP, funds developers who work on its maintenance, security, and new features. PHP 8.5 shipped on 20 November 2025, and php.net lists the 8.2 through 8.5 branches as supported today. Each release gets two years of active support and two more years of security fixes, which gives a new project a long runway.

Your goal	Does PHP fit?	Why
Build or extend a WordPress site	Yes	WordPress is built on PHP, so themes and plugins are PHP
A product with accounts, billing, and background jobs	Yes	Laravel and Symfony cover the repeated work
A small database-backed site on ordinary hosting	Yes	No build step, and a mature LAMP deployment path
Machine learning or data analysis	Rarely	Python has the larger ecosystem and the faster growth
A mobile app	No	PHP runs on servers, so a phone needs another language
Thousands of long-lived open connections	Awkwardly	A web request ends after the response; long work belongs in workers

What I like about PHP is how little ceremony stands between a form and a stored row. I ran PHP and MySQL on a LAMP server that I administered myself through the dot-com years, and that directness is why the language spread. The cost is thirty years of tutorials that nobody sorted by age, which the security section below deals with. Read the 2025 survey tables yourself before relying on my summary of them.

What Runs on PHP, and Who Uses It?

WordPress describes itself as built on PHP and MariaDB and licensed under the GPLv2, and it states that it powers over 43 percent of all sites across the web. Its requirements page recommends PHP 8.3 or greater and says that versions as old as 7.4 still work but have reached end of life. A newcomer who learns PHP can therefore read, fix, and extend the software that a large part of the web runs on.

Wikipedia is another large example of PHP in production. The MediaWiki manual says the software uses PHP to process and display data stored in a database, and it names Wikipedia as the site MediaWiki was built for. Facebook is a third, with a twist. Meta's engineering blog explained in 2014 that the company had migrated nearly its entire PHP codebase to Hack, a language it built to join the fast development cycle of PHP with static typing. A company that outgrew plain PHP kept the fast development cycle and added types, which tells a beginner how durable the model is.

Laravel is where most new PHP applications start today. Its documentation describes it as a framework for building modern web apps and AI agents. In the 2025 Stack Overflow survey WordPress was used by 13.6 percent of all respondents and Laravel by 8.9 percent, so both are widely used and neither is a niche tool.

What runs on PHP	What it is	Why people choose it
WordPress	A content management system	Publishing without building the admin screens
Laravel	An application framework	Accounts, queues, and billing already solved
MediaWiki	A wiki engine	It was built for Wikipedia's scale
Plain PHP	Scripts, forms, and small sites	The fewest moving parts

Where Did PHP Come From, and Is It Growing?

Rasmus Lerdorf created PHP in 1994 as a set of small CGI programs, called Personal Home Page Tools, that tracked visits to his online resume. Andi Gutmans and Zeev Suraski rewrote the parser in 1997, and the 1998 release became PHP: Hypertext Preprocessor. The php.net history page records about 60,000 domains using PHP by May 1998, roughly one percent of the Internet at the time.

The Zend Engine arrived with PHP 4 in 2000, PHP 5 followed in 2004, PHP 7 in 2015, and PHP 8 in 2020. Each step added speed or features while keeping the same model of one request in and one response out. Zeev Suraski tells the engine story in his own words in the interview on PHP's engine history.

The history matters for one practical reason. Search results still rank tutorials from the PHP 4 and PHP 5 era beside current ones, and some of that advice is unsafe today. The old advice section below lists the shapes to recognise. On growth, the survey line is flat, as the worth-learning section showed, so expect PHP to stay where it is.

Which PHP Version Should a New Project Use?

Use the newest branch that your host, your framework, and your plugins support, and check php.net on the day you start, because these dates move. As of 2 October 2026 the supported branches are the four below, and WordPress recommends PHP 8.3 or greater.

Branch	Active support ends	Security fixes end
PHP 8.5, released 20 November 2025	31 December 2027	31 December 2029
PHP 8.4, released 21 November 2024	31 December 2026	31 December 2028
PHP 8.3, released 23 November 2023	Ended 31 December 2025	31 December 2027
PHP 8.2, released 8 December 2022	Ended 31 December 2024	31 December 2026

My rule is to start new work on 8.5, accept 8.4 where a dependency has not caught up, keep 8.3 for applications already running on it, and treat 8.2 as a migration job with a deadline. Versions 8.0 and 8.1 are already marked end of life on php.net. An old tutorial that mentions them tells you its age, and the old advice section explains what else to distrust in it.

Why Does PHP Forget Everything Between Page Loads?

The rest of PHP assumes you know this rule, and it surprises people arriving from JavaScript or Python. A request arrives, your script runs with a clean set of variables, a response goes out, and everything your code put in memory is discarded. The next request starts from nothing again.

<?php

$visits = ($visits ?? 0) + 1;
echo "Visit number {$visits}";

This script prints "Visit number 1" on every request, forever. The variable is not shared between visitors, and it is not remembered between page loads by the same visitor, because no long-running process holds it. Anything that has to outlive a request must be stored somewhere deliberate: a session, a database row, a cache, or a file.

The phrase "shared-nothing" is often stretched too far, so be careful with it. What resets is your request state: variables, superglobals, and anything else your script created. The worker process underneath usually survives from one request to the next. Under PHP-FPM a pool of workers is reused across many requests, which is why compiled bytecode stays in OPcache between them and why a persistent database connection can be reused. Settings in php.ini are read when the process starts, so a change takes effect after an FPM reload.

The model also buys something concrete for the person running the server. Because each request begins clean, a bug that corrupts data in one request leaves no mess in memory for the next visitor to inherit, which long-running servers have to manage actively. The LAMP stack guide follows a single request the whole way through, and it is the fastest way to make this concrete.

PHP or Node for a Web Backend?

Node.js runs JavaScript on the server, so one language can cover the browser and the backend. PHP runs on the server only, so a PHP application pairs with JavaScript for anything interactive in the page. Both are free and open source, which means licence does not settle the choice, and both can run a serious production site.

Question	PHP	Node.js
How does a request run?	Fresh variables each request, with workers reused underneath	One long-running process can keep state in memory
Language reuse	Separate from browser JavaScript	The same language as the browser
Packages	Composer	npm
Long-lived connections	Possible in a command-line worker, awkward in a web request	A natural fit
Content sites and CMS work	The home ground, through WordPress	Possible, with fewer ready-made products
Survey usage in 2025	18.9 percent of respondents use the language	48.7 percent use Node.js, and 66 percent use JavaScript

The last row compares a language with a runtime, so read it as a size indicator rather than a ranking. Choose PHP for a content site, a WordPress extension, or a conventional database-backed application when the team does not already write JavaScript, because you reach a deployable application with fewer decisions. Choose Node when the browser and the server share types or when many long-lived connections matter.

The related JavaScript guide and the backend development hub cover the Node side in the meantime.

Which Backend Language Fits Which Job?

The table below sets PHP beside three other backend languages on this site. It gives the job each fits best and the signal that you should look elsewhere.

Language	Fits best	Look elsewhere when
PHP	CMS work, conventional web apps, small database sites	The job is data science or many persistent connections
JavaScript and TypeScript on Node	One language across browser and server	The team wants one mature framework with fewer choices
Python	Data, automation, and AI-adjacent backends	The product is mostly CMS pages on ordinary hosting
C#	Typed backends in teams that run .NET	The host or team has no .NET experience

Do I Need a Framework to Use PHP?

No, and a small site that stays small can run on plain PHP with PDO. A framework starts paying for itself when the same boundary work, such as routing, validation, authentication, and queues, repeats across the project. The PHP frameworks comparison weighs each option in detail, and the short version is in the table.

Option	Choose it for
Laravel	A product with users, billing, and background jobs
Symfony	A long-lived system with clear service boundaries
CakePHP	Predictable create, read, update, and delete screens
Slim	A small API with a thin framework
Fat-Free Framework	Staying close to plain PHP
Plain PHP and PDO	A small app whose boundaries have not repeated yet

Where Should I Run a PHP Site?

PHP asks little of the machine underneath it, which leaves a real choice about who looks after that machine. I prefer to run my own server and secure it properly, because I can read every setting and nothing in the setup depends on a vendor's terms. The cost is that patching, backups, and monitoring become my job, and a site left unpatched is worse than a site on managed hosting.

Option	What you look after	It fits when
Shared hosting	Your code and its settings	A small site, and little time for administration
Your own server (LAMP or LEMP)	Everything from the operating system up	You want control and will patch and back up on schedule
Containers	The image, its updates, and the deployment	You already deploy other services this way
A managed platform	Your code and configuration	You want another party to run PHP-FPM and its updates

Whichever you choose, run a supported PHP version and know which layer owns each setting. The LAMP stack guide explains the layers of a server you run yourself, the configuration guide explains where each setting lives, and the DevOps hub covers the server and terminal skills around them.

Is PHP Secure?

A PHP application is as secure as its handling of three boundaries: input arriving from the browser, text going into a database query, and text going back out into a page. The language supplies a tool for each one. The PHP manual states that a developer who exclusively uses prepared statements can be sure that no SQL injection will occur, with the caveat that any other part of the query built from unescaped input is still open. It also documents a native password hashing API and warns that fast algorithms such as MD5 and SHA1 are trivial to brute force.

The manual has a whole Security chapter covering sessions, the filesystem, databases, error reporting, user-submitted data, and a section titled Keeping Current. That last section recommends updating often and staying aware of the latest versions. php.net marks the 8.0 and 8.1 branches as end of life, so a host still running one of them may be exposed to unpatched vulnerabilities, whatever the code says.

I have cleaned up old LAMP applications whose entire security model was the sentence "escape the input". That slogan blurs three separate jobs, validating the shape of input, separating values from SQL, and escaping output for its context, into one, and each job needs its own tool. The security fundamentals guide separates them, and the authentication and sessions guide covers passwords, session rotation, and CSRF. For wider application security, see the AppSec hub.

Why Is Old PHP Advice Dangerous?

For most languages, stale advice is merely clumsy. For PHP a good deal of it is unsafe, because thirty years of tutorials sit online and search engines do not sort them by age. I lived through the move from mysql_* to PDO, and four shapes still identify an old tutorial quickly.

The old shape	What went wrong	Use instead
The mysql_* functions	Removed in PHP 7, so the code fails on supported versions	PDO with prepared statements
SQL built by joining strings	Input becomes part of the query, which is how injection incidents start	Prepared statements, bound values
addslashes, magic_quotes, register_globals	Settings removed in PHP 5.4, and escaping on the way in was the wrong model	Validate input, escape at output
Short open tags	Disabled in both shipped php.ini files, so code prints as plain text	Always write the full opening tag

The reliable test is the database call. If a snippet uses mysql_* or builds SQL by concatenation, it is old enough that everything else in it deserves checking too. The PDO guide shows the current way to reach a database.

How Do Coding Agents Change PHP Work?

Agents make the typing cheap and leave the judgement where it was. In the 2025 Stack Overflow survey, 84 percent of respondents used or planned to use AI tools, and 66 percent named solutions that are almost right, but not quite, as their biggest frustration. For PHP that gap has a specific shape. An agent can produce a form handler that works in a demo and still concatenates a value into SQL, so the person reviewing the diff needs the fundamentals this page routes you to.

Tooling is arriving on the PHP side. Laravel documents Laravel Boost, a development dependency installed through Composer that adds an MCP server (a protocol that lets an agent call tools in your project), guideline files, and agent skills. Its tools let an agent read the database schema, run a query, and read the last application error. The documentation search tool queries a hosted documentation service, so the first question I would ask is which tools leave the machine and which stay local.

The principle that applies to Boost is the one I apply to any terminal agent: treat it as a contractor with a narrow task and least permission. Give an agent a database account that can only read, and keep write access behind a migration you read yourself.

The agent does well	You still check
Boilerplate such as routes, forms, and migrations	That every database call is a prepared statement
Reading an unfamiliar codebase quickly	That its summary matches what the code does
Writing a first set of tests	That the tests fail when the code is wrong
Following the framework's conventions	That output is escaped for the page it lands in

Static analysis gives a second line of defence. The PHPStan project describes its tool as finding bugs in your code without writing tests, and PHP's typed properties and enums give it more to work with. Run it over agent output the way you would over a colleague's. The terminal AI agents guide covers the permission habits, and OpenCode is the open-source agent I prefer, because I can swap the model and see where my code goes. The cost is that setup and upkeep are mine.

How Hard Is PHP to Learn, and in What Order?

The start is gentle for anyone who has used a text editor and a terminal. There is no build step, and php -S localhost:8000 serves a folder of PHP files on your own machine. The hard part is the habits around the syntax, which are boundaries between input, database, and output. Agents lower the cost of typing a handler and leave the cost of judging it unchanged, so the order below puts the checking skills early.

1. Control flow: strict comparisons, match, and loops, so conditions say what you mean.
2. PDO with MySQL: prepared statements, typed values, and transactions from the first query.
3. Security fundamentals: validation, output escaping, uploads, and sessions before anything goes public.
4. Object-oriented PHP: classes as boundary tools, so a framework's layout makes sense.
5. Configuration and hosting: php.ini, PHP-FPM pools, and the move from your laptop to a server.
6. Frameworks: add one when the same boundary work repeats.

What Mistakes Do Beginners Make with PHP?

The same half dozen mistakes appear in almost every first PHP project, and each has a guide that fixes it.

• Copying an old tutorial: check the old advice table before pasting anything that touches a database.
• Building SQL by joining strings: use the PDO guide and bind every value.
• Trusting validation that runs in the browser: the security fundamentals guide puts the real checks on the server.
• Starting a framework before the request cycle is clear: the LAMP stack guide follows one request end to end.
• Editing the wrong php.ini: the configuration guide explains why the command line and PHP-FPM can read different files.
• Running a long loop inside a web request: the limits section below explains where background work belongs.

What Can't PHP Do?

PHP runs on the server, so it cannot touch the page after it has been sent. Clicking, dragging, validating a field as someone types, and updating part of a view without a reload all belong to JavaScript in the browser. A PHP application that feels interactive is a PHP application paired with JavaScript.

A web request also cannot keep work running after it responds. A scheduled job, a queue worker, or a background task belongs outside the request in cron, a command-line worker, or a queue service. The boundary is the web request and not the language, since PHP on the command line runs long-lived processes well. A long-running loop inside a web request ties up a PHP-FPM worker that other visitors are waiting on.

Browser-side validation is the third boundary, because it looks like a feature and offers no defence. Anyone can send a request that never touched your form. Validation you rely on happens in PHP, which is why application security treats the browser as untrusted input.

Which Guides Teach the Core of PHP?

These guides carry the ideas every other PHP page assumes. Read them roughly in this order, and return to the security guide whenever a project is about to face the public internet.

• PHP conditionals and control flow answers how to compare values strictly and choose between branches with if, switch, and match.
• Object-oriented PHP answers when classes, interfaces, and repositories help and when deep inheritance costs more than it saves.
• PHP configuration answers where a setting lives, from php.ini and scanned files to PHP-FPM pools and runtime overrides.
• PHP and MySQL with PDO answers how to run queries safely, with typed values, connection errors, and transactions.
• PHP security fundamentals answers how input validation, output escaping, uploads, and sessions fit together.
• PHP frameworks compared answers whether Laravel, Symfony, Slim, CakePHP, Fat-Free Framework, or plain PHP fits your application.
• Composer and supply-chain safety answers how to manage PHP dependencies and keep a lock file you can trust.

Which Guide Shows Me How to Build One Specific Thing?

The full hands-on collection lives on the PHP tutorials page: project builds, task walkthroughs, and the security references, grouped by subject. The most-used entries follow, grouped by the job you are trying to finish.

Forms, Input, and Email

Almost every PHP application starts here: something arrives from a user, gets checked, and triggers a message.

• Validate email addresses in PHP: the checks worth running server-side before an address is stored or mailed.
• Validate form input and spelling in PHP: checking what users typed beyond the format level.
• Send email from a PHP application: text and HTML mail with attachments, sent safely.
• Send SMS from PHP with an HTTP provider API: reaching phones through a gateway when email is not enough.

Working with Data and Files

The database walkthroughs build on the PDO guide; the file and XML pieces need only core PHP.

• Add search to a PHP and MySQL app: LIKE queries, relevance, and result pages.
• Add news posts and comments with PHP and MySQL: one-to-many data in a real page.
• Build PHP pagination with previous and next links: slicing large result sets into pages users can walk.
• Read and write text files with PHP: reading, writing, and appending without corrupting data.
• Process XML with PHP: parsing feeds and structured documents.
• Use recursion for tree-shaped PHP data: the technique behind directory walkers and nested menus.

Images, Media, and the Browser

PHP renders more than HTML: with GD it manipulates images, and with the right headers it controls how files and pages reach the browser.

• Create image thumbnails with PHP and GD: a directory thumbnail system, resized server-side.
• Composite images with PHP and GD: layering and overlapping images before they are served.
• Authorize protected media downloads with PHP: serving audio through PHP instead of direct file links.
• Add controlled browser polling to a PHP page: refreshing only when the data actually changed.

APIs and Lower-Level Plumbing

Where PHP talks to other programs rather than people.

• Build a JSON API with PHP: exposing your application's data for other clients to consume.
• Write a small PHP template system: separating markup from logic by hand, which is what every template engine automates.
• Use sockets and streams in PHP: talking to other servers below the HTTP layer.

Which Guides Build a Whole Application?

• The LAMP stack explained follows a request through Linux, Apache, MySQL, and PHP, then shows how PHP-FPM and containers change the deployment.
• Build a small PHP database app connects routing, validation, PDO, views, and database writes without hiding the request lifecycle.
• PHP authentication and sessions covers password hashing, session rotation, secure cookies, CSRF protection, and authorization boundaries.
• Build a mini chat app with PHP combines sessions, PDO, escaped output, CSRF protection, and polling in one project.

Which SQL Guides Go with PHP?

• Start with the SQL hub when the application stores relational data and you want to choose a database first.
• Use SQL joins when one PHP response needs related rows from several tables.
• Read SQL transactions and ACID before one request writes several related records.
• Review schema design basics when PHP code keeps repairing missing or duplicated relationships.

Frequently Asked Questions

Is PHP still supported?

PHP 8.2 through 8.5 all receive support as of October 2026, although 8.2 and 8.3 get security fixes only. PHP 8.2's security support ends on 31 December 2026, so do not start new work on it. Each release gets two years of active support and then two further years of security fixes.

Is PHP compiled or interpreted?

Interpreted, in the sense that there is no build step to run. Internally the Zend Engine compiles source to bytecode before executing it, and OPcache keeps that compiled form between requests, which is where much of PHP's modern speed comes from.

What does Composer do?

Composer records PHP package requirements and generates an autoloader for project classes and installed packages. It replaces chains of manual require statements with one declared dependency and namespace boundary. Even a small project can use it for predictable loading, and the Composer guide covers composer.json, the lock file, and safe updates.

How does PHP reach a database?

PHP commonly reaches relational databases through PDO or a framework database layer built above it. Use prepared statements to keep application values separate from SQL text, bind values with the correct types, and place multi-step writes inside a transaction when they must succeed together.

Can PHP run without Apache or Nginx?

It can, and there are two common ways to do it. PHP has a built-in development server started with php -S, which is fine for local work and unsuitable for production. It also runs as a command-line language for scripts, cron jobs, and build tooling with no web server involved.

What is PHP-FPM?

The FastCGI Process Manager, which keeps a pool of PHP worker processes ready and hands requests to them. It is how PHP is normally run behind Nginx, and it is where you tune how many concurrent requests a server will accept.

How does PHP compare with JavaScript for web work?

PHP runs on the server only, while JavaScript runs in the browser and, through Node, on the server too. A PHP application still needs JavaScript for anything interactive in the page, so the two are usually paired rather than compared.

Where to Start

Build one page that reads from a database and one form that writes to it, using PDO and prepared statements from the first line. Work through control flow if the syntax is new, then PDO with MySQL, then security fundamentals before anything goes public. The small database app guide assembles the same pieces as a worked build.