PHP Quiz

1. Where does PHP code run?

• In the visitor's browser
• On the server, which sends the resulting output (usually HTML) to the browser
• In the database
• Only on Windows servers

The browser never sees the PHP code, only its output (lesson 01).

2. Why should a file containing only PHP code leave out the closing ?> tag?

• PHP requires it to be omitted
• It avoids accidentally sending whitespace after it, which can cause "headers already sent" errors
• It makes the script faster
• Closing tags are deprecated

(lessons 03 and 50)

3. What does echo 'Hi $name'; print?

• Hi $name
• Hi followed by the variable's value
• Nothing — it's a syntax error
• Hi

Variables are only interpolated in double-quoted strings and heredocs (lesson 16).

4. What does var_dump(7 / 2); show?

• int(3)
• float(3.5)
• int(4)
• string(3) "3.5"

Use intdiv() for integer division (lesson 08).

5. Which of these values is truthy?

• "0"
• []
• "0.0"
• 0

"0" is falsy but "0.0" is not (lesson 09).

6. Why prefer === to ==?

• It's faster to type
• It compares both value and type, avoiding surprising type juggling
• == is deprecated
• === works on arrays only

(lesson 09)

7. What's the difference between ?? and ?:?

• None
• ?? only replaces null or missing values; ?: replaces any falsy value
• ?: only works with strings
• ?? throws when the value is missing

So 0 ?? 5 is 0, but 0 ?: 5 is 5 (lesson 10).

8. What happens when a match expression gets a value no arm handles?

• It returns null
• It uses the first arm
• It throws an UnhandledMatchError
• Nothing; execution continues

Add a default arm when a fallback makes sense (lesson 13).

9. Why is if (strpos($s, 'apple')) a bug?

• strpos doesn't exist
• A match at position 0 is falsy, so it's treated like "not found"
• It's case-insensitive
• It always returns true

Compare with !== false, or use str_contains (lesson 17).

10. Why use mb_strlen instead of strlen for user names?

• It's faster
• strlen counts bytes, and many characters take several bytes in UTF-8
• strlen doesn't work on strings with spaces
• mb_strlen trims the string first

(lesson 19)

11. After $a = [1, 2]; $b = $a; $b[] = 3;, what is count($a)?

• 2
• 3
• 1
• It's an error

Arrays are copied on assignment; objects are not (lessons 21 and 33).

12. What does array_filter do to the keys of the elements it keeps?

• Renumbers them from 0
• Keeps the original keys, which can leave gaps
• Converts them to strings
• Removes them

Wrap the result in array_values() for a clean list (lesson 23).

13. What does sort($numbers) return?

• The sorted array
• true — it sorts the array in place
• A new array, leaving the original unchanged
• The number of elements

(lesson 24)

14. What does declare(strict_types=1) do?

• Makes all variables constants
• Stops PHP from converting scalar arguments to match parameter types, so "5" passed to an int parameter is a TypeError
• Disables warnings
• Requires every variable to be declared

(lesson 29)

15. Can a function read a variable defined outside it, without passing it in?

• Yes, always
• No — functions have their own scope, unless you use global (best avoided)
• Only if the variable is an array
• Only inside classes

Pass values in as parameters instead (lesson 30).

16. What does fn($x) => $x * $rate do with $rate?

• Captures it automatically, by value
• Throws an error because $rate isn't passed in
• Captures it by reference
• Treats it as a global

Full closures need use ($rate) (lesson 31).

17. What does PHP 8.5's $x |> f(...) mean?

• Bitwise OR of $x and f
• Call f($x) — the pipe operator passes the left value into the callable
• Compare $x with f
• Define a function f

(lesson 31)

18. What does constructor promotion do in public function __construct(public string $name) {}?

• Makes the constructor public
• Declares a $name property and assigns the argument to it
• Converts the argument to a string
• Nothing; it's just a parameter

(lesson 34)

19. What does public private(set) float $balance mean?

• The property is private
• Anyone can read it, but only the class itself can change it
• It can be set once
• It's a computed property

Asymmetric visibility, PHP 8.4 (lesson 35).

20. What is the main difference between an interface and an abstract class?

• A class can implement many interfaces but extend only one class; abstract classes can contain shared code
• Interfaces can have properties; abstract classes can't
• Abstract classes can be instantiated
• There is no difference

(lesson 38)

21. Why use a backed enum (enum Status: string) instead of a pure enum?

• Backed enums are faster
• Each case has a scalar value, so it can be stored in a database or JSON and restored with from()/tryFrom()
• Pure enums can't have methods
• Pure enums can't be used in match

(lesson 40)

22. Inside the namespace App\Services, what does new Exception() look for?

• The global Exception class
• App\Services\Exception — so you need use Exception; or \Exception
• Any class called Exception
• The nearest parent namespace

(lesson 43)

23. What's the advantage of a generator over returning a big array?

• Generators are always faster
• Values are produced one at a time, so memory use stays low even for huge data
• Generators can be iterated many times
• Generators sort their values

(lesson 45)

24. Which statement about form data is true?

• HTML required attributes make server validation unnecessary
• Users can send any data, so the server must validate everything
• $_POST values are already escaped
• Hidden fields can't be changed by users

(lessons 46–47)

25. What prevents cross-site scripting (XSS) when displaying a user's comment?

• Storing it in a session
• Escaping it with htmlspecialchars() when printing it into HTML
• Using a prepared statement
• Hashing it

(lesson 47)

26. Why call session_regenerate_id(true) after a successful login?

• To log the user out of other devices
• To give the session a new ID, defeating session-fixation attacks
• To store the password in the session
• It's required before session_start()

(lesson 48)

27. Why is trusting a cookie like is_admin=1 a serious mistake?

• Users can edit their own cookies freely
• Cookies expire too quickly
• Cookies can't hold numbers
• It is fine if the cookie is HttpOnly

Keep authorisation data in the server-side session (lesson 49).

28. What should usually follow header('Location: /done.php');?

• Nothing
• exit; — otherwise the rest of the script keeps running
• echo of the page content
• session_destroy()

(lesson 50)

29. What's the only reliable defence against SQL injection?

• Removing quotes from input
• Using htmlspecialchars on input
• Prepared statements with placeholders for every value
• Hiding database error messages

(lesson 58)

30. How should passwords be stored?

• Encrypted with a secret key
• As an md5 or sha1 hash
• With password_hash(), and checked with password_verify()
• As plain text in a separate table

(lesson 59)