Top 15 PHP Interview Questions for Freshers with Answers

Q1. echo vs print?

Both are language constructs. echo takes multiple comma-separated values and returns nothing; print takes one value and returns 1, so only print can sit inside an expression. In practice, echo everywhere.

Q2. == vs ===?

== compares after type juggling (5 == "5" is true, and 0e-style "magic hashes" collide); === compares value and type with no conversion. Professional default is === — and strpos() results MUST use === false.

Q3. isset() vs empty()?

isset = exists and not null; empty = any falsy value including 0 and "0". Trap: never validate numeric fields with empty() — a genuine zero gets rejected.

Q4. include vs require (and _once)?

Same job; include warns and continues on a missing file, require throws a fatal and stops. Critical files (config, auth) → require; the _once versions skip repeat loads, preventing "Cannot redeclare" errors.

Q5. GET vs POST?

GET carries data in the URL — visible, ~2KB, bookmarkable, for read-only requests. POST carries it in the body — hidden from URL, supports uploads, required for anything that changes data. POST alone isn't security; HTTPS is.

Q6. What are PHP superglobals?

Built-in arrays available everywhere: $_GET, $_POST, $_REQUEST, $_SESSION, $_COOKIE, $_FILES, $_SERVER, $GLOBALS. They carry request data, uploaded files and server info into your script.

Q7. Session vs cookie?

Cookie lives in the browser — user-readable and editable, long-lived, for preferences. Session lives on the server with only the ID in a cookie — tamper-proof, for login state and roles. Never store is_admin in a cookie.

Q8. How do you prevent SQL injection?

Prepared statements — user input travels separately from the SQL text via placeholders (PDO :named or ? positional). Never concatenate input into queries. Bonus mention: PDO::ERRMODE_EXCEPTION for clean errors.

Q9. How do you prevent XSS?

htmlspecialchars() on every piece of user input echoed into HTML — script tags become harmless text. Pair rule with Q8: output→escape, database→placeholders.

Q10. How should passwords be stored?

Never plain, never md5/sha1. Use password_hash($p, PASSWORD_DEFAULT) to store and password_verify($input, $hash) to check — automatic salting, future-proof algorithm.

Q11. What causes "headers already sent"?

Any output (even a space before <?php or after ?>) before header(), session_start() or setcookie() — headers must precede the body. Fix: session_start() first line, and omit the closing ?> in pure-PHP files.

Q12.

$x = "5"; $y = 5;
var_dump($x == $y);
var_dump($x === $y);

true then false — juggling equalizes value; strict sees string vs int.

Q13.

$a = array(1, 2, 3);
$b = $a;              // arrays COPY in PHP (unlike Python lists!)
$b[] = 4;
echo count($a);

3 — assignment copies the array; $a is untouched. (Objects, in contrast, share.)

Q14.

function addFive(&$n) { $n = $n + 5; }
$m = 10;
addFive($m);
echo $m;

15 — the & makes the parameter a reference; the function modified the original variable.

Q15.

echo 0.1 + 0.2 == 0.3 ? "equal" : "not equal";

not equal — floating point (0.30000000000000004). Compare floats with a tolerance or use round(); never == on money — store paise as integers.