PHP Case Studies & Practical Application 5

Question 1

You need to parse an XML feed from a third-party supplier in PHP. Which extension is preferred for reading large XML files without loading the entire document into memory?

Accepted Answer

XMLReader (stream-based SAX-style parser)

Answer

XMLReader reads XML as a forward-only stream, processing nodes one at a time and keeping memory usage constant regardless of file size.

Question 2

A PHP application must prevent the same form from being submitted twice if the user clicks the submit button rapidly. What is the standard server-side solution?

Accepted Answer

Generate a unique CSRF/nonce token per form, store it in the session, and invalidate it after first use

Answer

A one-time server-side nonce ensures duplicate submissions are rejected even if JavaScript is disabled or bypassed.

Question 3

Your PHP application uses Composer. A developer installs a package that pulls in a dependency with a known CVE. What is the correct way to detect this?

Accepted Answer

Run composer audit to check installed packages against the PHP Security Advisories Database

Answer

composer audit queries the security advisories database and reports any installed package versions with known vulnerabilities.

Question 4

A multi-tenant PHP SaaS app stores all customers in one database with a tenant_id column. A query forgets to filter by tenant_id. What is the result?

Accepted Answer

One tenant can read or modify another tenant's data (data leakage)

Answer

Missing tenant isolation filters in a shared database architecture lead to cross-tenant data exposure, a critical security vulnerability.

Question 5

You refactor a PHP function to use type declarations. The function signature is `function total(int $qty, float $price): float`. What happens when it's called with total('3', '9.99')?

Accepted Answer

In strict mode (declare(strict_types=1)), a TypeError is thrown; without strict mode, PHP coerces the strings to int and float

Answer

PHP's type coercion applies in weak mode, but declare(strict_types=1) disables coercion and enforces exact types, throwing a TypeError on mismatch.

PHP - PHP Programming Language Practice Test

PHP - PHP Programming Language Practice Test

PHP Case Studies & Practical Application 5