PHP Case Studies & Practical Application 2 — Questions and Answers
Question 1: You are building a REST API in PHP that receives JSON payloads. Which function correctly decodes the incoming request body into a PHP associative array?
- json_decode(file_get_contents('php://input'), true) (Correct answer)
- json_decode($_POST['body'], true)
- json_decode($_REQUEST['data'])
- json_decode(file_get_contents('php://stdin'))
Correct answer: json_decode(file_get_contents('php://input'), true)
php://input provides the raw request body, and passing true as the second argument to json_decode returns an associative array instead of an object.
Question 2: A legacy PHP application concatenates user input directly into SQL queries. What is the safest modern fix?
- Use PDO with prepared statements and bound parameters (Correct answer)
- Wrap the input in htmlspecialchars() before inserting
- Use mysql_real_escape_string() on all inputs
- Validate input length before inserting
Correct answer: Use PDO with prepared statements and bound parameters
PDO prepared statements separate SQL logic from data, completely preventing SQL injection regardless of input content.
Question 3: Your PHP script processes large CSV uploads and times out. Which approach best resolves the timeout without increasing max_execution_time?
- Process the file in chunks using a generator that yields rows one at a time (Correct answer)
- Load the entire file into an array with file() and loop over it
- Use ob_flush() after every row
- Convert the CSV to JSON before processing
Correct answer: Process the file in chunks using a generator that yields rows one at a time
Generators process data lazily one row at a time, keeping memory low and allowing the script to complete without hitting execution limits.
Question 4: A team needs multiple developers to share session data across two PHP app servers behind a load balancer. What is the correct approach?
- Store sessions in a shared Redis instance using session_set_save_handler() (Correct answer)
- Rely on PHP's default file-based sessions and hope sticky sessions work
- Serialize session data into a cookie
- Use $_GLOBALS to share state between requests
Correct answer: Store sessions in a shared Redis instance using session_set_save_handler()
A centralized session store like Redis ensures any server can read any user's session, solving the stateless server problem.
Question 5: You need to send a transactional email in PHP when a user registers. Which approach is most production-ready?
- Use a library like PHPMailer or Symfony Mailer with an SMTP relay service (Correct answer)
- Call PHP's built-in mail() function directly
- Write the email raw to a socket connection on port 25
- Append the email to a log file for manual sending
Correct answer: Use a library like PHPMailer or Symfony Mailer with an SMTP relay service
PHPMailer with an SMTP relay provides authentication, TLS encryption, proper headers, and reliable delivery tracking.
Question 6: A PHP application stores uploaded images in the webroot. What security risk does this introduce?
- Attackers could upload PHP files and execute them via URL (Correct answer)
- Images consume too much CPU when served
- The webserver cannot serve binary files from the webroot
- HTTPS certificates won't cover files in the webroot
Correct answer: Attackers could upload PHP files and execute them via URL
If a PHP file is uploaded disguised as an image, the web server may execute it, giving attackers remote code execution.
Question 7: Which PHP pattern is appropriate for a class that must ensure only one database connection exists throughout the application lifecycle?
- Singleton pattern (Correct answer)
- Factory pattern
- Observer pattern
- Decorator pattern
Correct answer: Singleton pattern
The Singleton pattern restricts instantiation to one object and provides a global access point, making it suitable for shared resources like DB connections.
PHP Case Studies & Practical Application 2
You are building a REST API in PHP that receives JSON payloads.
Which function correctly decodes the incoming request body into a PHP associative array?