PHP Case Studies & Practical Application 3 — Questions and Answers
Question 1: You inherit a PHP app with no error logging. Users report intermittent blank pages. What is the fastest first diagnostic step?
- Set error_reporting(E_ALL) and log_errors=On in php.ini, then reproduce the issue (Correct answer)
- Delete the cache directory and restart Apache
- Disable all PHP extensions one by one
- Switch the app to CLI mode and run it manually
Correct answer: Set error_reporting(E_ALL) and log_errors=On in php.ini, then reproduce the issue
Enabling full error reporting and logging captures the actual fatal error or exception causing the blank page without exposing it to users.
Question 2: A PHP e-commerce checkout must charge a credit card and then save the order. If the charge succeeds but DB insert fails, what pattern prevents charging without saving?
- Wrap both operations in a database transaction and rollback if either fails (Correct answer)
- Save to the DB first, then charge the card
- Use a try/catch and email the admin on DB failure
- Use file_put_contents as a backup record before the DB insert
Correct answer: Wrap both operations in a database transaction and rollback if either fails
A database transaction ensures atomicity: if the DB insert fails after a successful charge, the transaction rolls back and compensating logic can refund the charge.
Question 3: Your PHP application caches rendered HTML in files. After a content update the old cache is served. What is the cleanest cache-busting approach?
- Delete or overwrite the cached file when content is updated, or use a hash-based cache key (Correct answer)
- Add a random query string to all URLs
- Increase the file modification time with touch()
- Disable caching during business hours
Correct answer: Delete or overwrite the cached file when content is updated, or use a hash-based cache key
Invalidating the cache file on content update or keying it by a content hash ensures fresh content is served immediately after changes.
Question 4: A PHP CLI script runs nightly to import 500,000 rows from an external API into MySQL. Memory runs out mid-import. What is the best fix?
- Use PDO with unbuffered queries and insert rows in batches rather than collecting all data in memory (Correct answer)
- Increase memory_limit in php.ini to 4GB
- Convert all data to CSV strings before inserting
- Run the script in a browser request instead of CLI
Correct answer: Use PDO with unbuffered queries and insert rows in batches rather than collecting all data in memory
Batched inserts with unbuffered streaming keeps memory usage constant regardless of total row count.
Question 5: You need to implement role-based access control in a PHP MVC app. Where is the correct place to enforce authorization checks?
- In a middleware or base controller that runs before the action method (Correct answer)
- At the bottom of each view template
- Only in JavaScript on the frontend
- In the database layer when data is fetched
Correct answer: In a middleware or base controller that runs before the action method
Middleware or base controller hooks intercept every request before business logic runs, preventing unauthorized code paths from executing at all.
Question 6: A PHP API endpoint returns user profile data including a hashed password field. What should be done?
- Explicitly exclude sensitive fields before serializing the response (Correct answer)
- Return all fields and let the client ignore what it doesn't need
- Encode the hash with base64 before returning it
- Only hash the password again before sending it
Correct answer: Explicitly exclude sensitive fields before serializing the response
Sensitive fields like password hashes should never be exposed in API responses; whitelist only the fields that clients legitimately need.
Question 7: Which PHP function should you use to hash passwords before storing them in a database?
- password_hash($password, PASSWORD_BCRYPT) (Correct answer)
- md5($password)
- sha1($password)
- base64_encode($password)
Correct answer: password_hash($password, PASSWORD_BCRYPT)
password_hash() uses bcrypt by default, automatically salting the hash to prevent rainbow table attacks.
PHP Case Studies & Practical Application 3
You inherit a PHP app with no error logging.
Users report intermittent blank pages.
What is the fastest first diagnostic step?