PHP Cheat Sheet 2026

The 30 highest-yield PHP facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. A PHP application accepts a filename from a GET parameter and passes it to include(). What risk does this introduce? → Local/Remote File Inclusion (LFI/RFI)
2. Which PHP class is used to create a SOAP client for communicating with SOAP-based web services? → SoapClient
3. A PHP form saves a user bio with HTML tags to a database and later displays it. Which step is critical at display time? → Escape output with htmlspecialchars() when rendering the bio in HTML
4. What is the default visibility of class properties and methods in PHP if no modifier is specified? → public
5. Which Composer command should you run before deploying a PHP application to production? → composer install --no-dev --optimize-autoloader
6. What does the PHP Composer tool manage? → Package dependencies
7. What does the abstract keyword mean when applied to a PHP class? → The class cannot be instantiated directly
8. In terms of GDPR data transfer compliance, what must a PHP application implement when sending personal data from the EU to a US-based third-party API? → Ensure the recipient has adequate protections via SCCs, BCRs, or adequacy decision
9. Under GDPR's 72-hour breach notification rule, what must a PHP application have in place to detect a data breach quickly? → Real-time logging and alerting systems that detect anomalous data access patterns
10. Isn't it true/false that all variables in PHP begin with a $(dollar) sign? → B) True
11. Which PHP magic method defines how an object behaves when cast to a string? → __toString()
12. Is it possible to run PHP from the command line? → Yes
13. What is the primary risk of using eval() with user-supplied input in PHP? → Arbitrary code execution
14. Which PHP ini setting should be enabled in compliance environments to prevent session fixation attacks? → session.use_strict_mode = 1
15. Which PHP practice violates the principle of least privilege, a core requirement in ISO 27001 and SOC 2 frameworks? → Connecting to the database with a root or superuser account in the application
16. What does CORS stand for in the context of PHP web APIs communicating with browsers? → Cross-Origin Resource Sharing
17. Which PHP OPcache function forces the current cached version of a file to be invalidated, useful when testing if new code changes are picked up? → opcache_invalidate()
18. Which PHP pattern is appropriate for a class that must ensure only one database connection exists throughout the application lifecycle? → Singleton pattern
19. Which superglobal holds data submitted via an HTML form using the POST method? → $_POST
20. What is the primary value of case study analysis in PHP Programming Language training? → Developing critical thinking by applying theory to realistic professional scenarios
21. Which PHPUnit assertion should you use to verify a string contains a specific substring? → assertStringContainsString()
22. What is the recommended technique for preventing CSRF attacks in PHP form submissions? → Generate and validate unique per-session CSRF tokens in every form
23. Which PHP function is used to redirect a user's browser to another URL? → header('Location: ...')
24. Which loop in PHP is guaranteed to execute its body at least once? → do-while
25. Under COPPA regulations, what must a PHP web application verify before collecting data from users who may be under 13? → Verifiable parental consent
26. Is it true/false that once a variable is declared, it can only be used once in the PHP source code? → A) False
27. What does PDO::rollBack() do in PHP? → Undoes all changes made since the transaction began
28. A legacy PHP application concatenates user input directly into SQL queries. What is the safest modern fix? → Use PDO with prepared statements and bound parameters
29. What is a risk mitigation strategy in PHP Programming Language practice? → Implementing controls that reduce the likelihood or impact of identified risks
30. Which keyword is used to define a class in PHP? → class