PHP Glossary from A to Z — PHP

PHP Glossary — 124 definitions

All the terms defined in the 25 sections of the guide, listed in alphabetical order.
Tip: press Ctrl + F to search for a term on the page.

“It works on my machine”: The problem Docker solves (common in PHP: versions, extensions, config, Windows/Linux case sensitivity): the container ships its environment, running identically everywhere.
== vs === / quotes: `==` compares with type conversion (loose, surprising); `===` compares value AND type (strict, preferred). Double quotes interpret variables, single quotes = literal.
$_GET vs $_POST: GET: data in the URL (visible, for searches/filters/links). POST: data in the body (not visible, for forms that modify things, sensitive data).
REST API: An interface exposing data (as JSON) consumed by other programs (front end, mobile, services); resources via URLs, semantic HTTP methods, status codes.
Clean architecture: Separating layers, decoupling, depending on abstractions, readable code; produces maintainable, flexible, testable, evolvable code.
Assertions: Checks a test performs: assertEquals(expected, result), assertTrue, assertNull…; they fail when reality doesn't match expectations.
Token-based authentication: For APIs (stateless, separate front end/mobile): after login, the server issues a TOKEN that the client returns with each request (Authorization header) and that the server verifies.
Session-based authentication: Login: verify username + password, store identity in the session; protected pages: check the session; logout: destroy the session.
Autoloading (PSR-4): AUTOMATICALLY loads a class's file when used (no more manual includes), via a convention (PSR-4) mapping namespaces to folder structure.
PHP tags: PHP code goes between `<?php` and `?>`; outside the tags = HTML (sent as-is), inside = PHP code (executed). Lets you mix PHP and HTML.
Database / MySQL: A system durably storing data (users, products…). MySQL/MariaDB: a RELATIONAL database (tables, rows, columns) queried in SQL (SELECT/INSERT/UPDATE/DELETE = CRUD).
Docker benefits: Reproducibility (identical everywhere), isolation (different PHP versions without conflicts), portability, easy deployment, fast onboarding (docker compose up).
Testing benefits: Confidence (the code does what it should), NO REGRESSION (catching what a change breaks), documentation (expected behavior), better design (testable code = better structured), early bug detection.
Blade (templates): Laravel's template engine: clean syntax ({{ }}, @foreach, @if) with AUTOMATIC ESCAPING (XSS protection by default) and reusable layouts (inheritance).
Loop: Repeats processing instead of duplicating code; essential for handling collections or repeating an action.
break / continue: break: EXITS the loop immediately. continue: SKIPS to the next iteration. Watch out for INFINITE loops (a condition that never becomes false).
CI/CD (GitHub Actions): Automating code → production: CI (on each push, test/verify — PHPUnit), CD (deploy automatically when checks pass). GitHub Actions/GitLab CI build these pipelines.
Closures / native functions: Anonymous (closures) and arrow functions: nameless, storable/passable (callbacks). PHP has hundreds of native functions (strlen, array_map…) — check the docs.
Comments: Text ignored by PHP explaining the code: `//` or `#` (one line), `/* ... */` (multiple lines); essential for readability.
Symfony components: Symfony is made of independent components (routing, forms, security, console…) usable separately; many projects (including Laravel) use them under the hood.
Composer: PHP's DEPENDENCY manager (the npm equivalent): installing external libraries and managing their versions; transformed the PHP ecosystem.
composer.json / vendor: composer.json declares dependencies; `composer install` downloads them (vendor/ folder, not versioned, regenerable) and generates the autoloader (vendor/autoload.php). composer.lock pins versions.
Concatenation (.): In PHP, strings are joined with the DOT `.` (not `+`): `'Hello ' . $name`.
Configuration & secrets: Settings and SECRETS (database credentials, keys) provided by the production environment, NEVER in the code/Git repository (environment variables, .env outside the repo).
Controller: The LINK: receives the request, calls the Model for data, picks the View to render with that data; orchestrates model and view.
Cookies ($_COOKIE): Small data stored in the BROWSER, sent back with each request (setcookie / $_COOKIE); client-side (modifiable) — security options HttpOnly, Secure, SameSite.
Server side vs client side: Server (PHP): runs the logic (forms, database, authentication) and generates pages. Client (browser): displays HTML/CSS and runs JavaScript.
CRUD: The four basic operations: Create (INSERT), Read (SELECT), Update (UPDATE), Delete (DELETE); done with PDO and prepared statements, with fetching (fetch/fetchAll).
CSRF → tokens: Tricking a logged-in user into performing an action unknowingly (forged request); protection: CSRF tokens (unique per form, verified) and the SameSite cookie.
Request → PHP → HTML cycle: The user requests a page → the server runs the PHP code → PHP generates HTML → the browser displays it. This cycle replays on every request.
Dates (DateTime): Modern PHP handles dates with the DateTime/DateTimeImmutable class: create, FORMAT for display (->format), compute differences (->diff), add/subtract.
Deployment / hosting: Running the PHP application on a server accessible over the Internet. Options: shared hosting (simple, cheap), PaaS (simplified), VPS (control + responsibilities), cloud.
Design patterns: TRIED-AND-TESTED solutions to recurring design problems (validated organization recipes); they give a shared vocabulary. E.g. Factory, Repository, Strategy, Observer, Dependency Injection.
Judgment (vs over-engineering): Applying patterns and SOLID with MEASURE according to the problem; over-engineering (needlessly excessive structure) is a trap just like under-engineering (mess). Find the right level.
Docker / containerization: A tool packaging an application WITH its whole environment (PHP, extensions, config, dependencies) into an isolated, portable container that runs identically everywhere.
Docker Compose (PHP stack): A docker-compose.yml file defining several containers (PHP/Nginx + MySQL + Redis…) and their relationships, launched together (docker compose up); describes the whole PHP stack.
Doctrine (ORM): Symfony's ORM: manipulating ENTITIES (objects) instead of SQL, automatic prepared statements, relations, migrations; a “Data Mapper” approach (vs Eloquent's Active Record).
Web root folder / localhost: The folder where .php files go (htdocs, www) so they get served; accessed via http://localhost (your own machine).
echo: A construct to DISPLAY (produce output): `echo 'Hello';` generates text/HTML in the page. The fundamental output tool (also `print`).
Eloquent (ORM): Laravel's ORM: tables ↔ classes (models), rows ↔ objects; manipulating the database via objects/methods (Product::all()) instead of SQL, with automatic prepared statements and relation handling.
Encapsulation / visibility: Grouping data and behavior, and controlling access via visibility: public (everywhere), private (class only), protected (class + descendants). Private properties + getters/setters to protect state.
Local environment (AMP): What you need to run PHP and a database on your machine to develop/test. AMP = web server (Apache), PHP, database (MySQL) — often installed together via a pack.
Sending emails: The native mail() function is basic/unreliable; use dedicated libraries (PHPMailer, Symfony Mailer) for reliability. Never inject uncontrolled data into headers.
PHP production essentials: HTTPS, errors NOT displayed (logged), OPcache enabled, optimized Composer autoloader, migrations run at deploy time, separate environments (dev/staging/prod).
Regular expressions (regex): A mini-language describing patterns in text; preg_match (does it match?), preg_replace (replace). Powerful but hard.
filter_var for validation: For common validations (email, URL…), prefer filter_var (FILTER_VALIDATE_EMAIL…) over a homemade regex — more reliable. Reserve regex for specific patterns.
Function: A reusable block of code performing a task: `function greet($name) { return ... }`, called by its name. Avoids duplication, improves readability and maintenance.
Array/string functions: Hundreds of native functions: arrays (count, in_array, array_map/filter/reduce, sort, implode/explode…), strings (strlen, str_replace, substr, trim, str_contains…).
Multibyte functions (mb_): To correctly handle Unicode (accented/non-Latin characters): mb_strlen, mb_substr…; classic functions work on bytes (a problem in UTF-8).
for: A counter loop, when you know the number of repetitions: `for ($i = 0; $i < 10; $i++) { ... }` (initialization; condition; increment).
foreach: The loop for GOING THROUGH an array (the most used): `foreach ($arr as $value)` (each value) or `foreach ($arr as $key => $value)` (key → value pairs).
Form / superglobals: Forms send data to the server, which PHP retrieves via superglobals (special arrays available everywhere): $_GET, $_POST, $_FILES, $_SESSION…
Timezone & storage format: Watch points: configure the TIMEZONE (otherwise wrong times); STORE dates in a standard format (ISO YYYY-MM-DD) and FORMAT them only at display time.
File handling: Reading/writing server files: file_get_contents, file_put_contents, fopen/fread/fwrite, file_exists, unlink (delete).
Git for deploying: Deploying via Git (the server pulls the code from the repository) rather than transferring files by hand (FTP) — more reliable and traceable.
Hashing / HTTPS / secrets: HASHED passwords (password_hash/verify, never plain text); HTTPS (encryption); secrets outside the code (environment variables); errors not displayed in production; up-to-date dependencies.
Inheritance: A class inherits from another (`class Admin extends User`): it gets its properties/methods, can add or OVERRIDE some; enables reuse and specialization.
Stateless HTTP: Each HTTP request is independent, the server remembers nothing of previous ones; cookies and sessions add a “memory” between pages.
if / elseif / else: Runs a block IF a condition is true; else (otherwise), elseif (else if, several conditions in a chain). The condition evaluates to true/false.
Image / Dockerfile / container: Image: a frozen template of the app + environment, defined by a Dockerfile (recipe: base PHP image, extensions, code, Composer dependencies). Container: a running instance.
include / require: Insert one file's contents into another. require: FATAL error if missing (essential files). include: warning and continues (optional ones).
SQL injection: A CRITICAL flaw: concatenating user data into an SQL query lets an attacker inject malicious SQL (read/modify/destroy the database). To be avoided at all costs.
SQL injection → prepared statements: Injecting SQL via concatenated data; protection: ALWAYS prepared statements (PDO), never concatenation in SQL.
Interfaces / traits: Interface: a “contract” of methods a class must implement (programming by contract, decoupling). Trait: reusing methods across several classes without inheritance (horizontal sharing).
PHP interpreter: The program running PHP code on the server; the visitor never sees PHP code, only the resulting HTML.
JWT (JSON Web Token): A cryptographically SIGNED token (self-contained, no server storage), very common for APIs; returned with each request and verified. Suited to separate front ends and mobile.
Laravel: The most popular PHP framework (elegant, productive, vast ecosystem); implements MVC and provides powerful tools applying best practices. The modern PHP reference.
Laravel vs Symfony: Two excellent mature frameworks: Laravel more accessible/productive; Symfony more rigorous/modular/enterprise. Same concepts (MVC, ORM, templates) — transferable.
Migrations: A system versioning the database structure (creating/modifying tables via versioned PHP code): reproducible structure, traceable evolution — essential in teams and at deploy time.
Caching (Redis): Storing costly results (frequent queries, computations, pages) so they aren't redone; Redis (or Memcached) = fast IN-MEMORY storage used as cache. Often the most impactful lever.
Model: Handles DATA and BUSINESS LOGIC: database access, entities (User, Product), business rules — independently of display.
MVC (Model-View-Controller): An architecture pattern splitting the application into three responsibilities: Model (data/business logic), View (display), Controller (coordination). The foundation of web frameworks.
Namespaces: Organize classes into logical “spaces” and avoid NAME conflicts (two `User` classes coexist in different namespaces). Declared with `namespace App\Models;`, imported with `use`.
Never trust input: Any user data (form, URL) is potentially wrong or malicious; always validate and sanitize SERVER-SIDE before using it.
Don't optimize prematurely: Correct and clear code first, MEASURE when a problem occurs, then optimize in a TARGETED way. Optimizing too early wastes time and needlessly complicates things.
Test levels: Unit (one isolated function/class), integration (several parts together, e.g. with the database), functional/end-to-end (the application as a user).
Null coalescing ?? / match: `??` returns the left side if it exists and isn't null, otherwise the right side (default values). `match` (PHP 8+) = a modern switch, strict, returning a value.
OPcache: An extension caching compiled PHP bytecode: compilation happens only once (instead of on each request) — a MAJOR, nearly free performance gain. Enable it, especially in production.
Operators: Arithmetic (+ - * / % **), assignment (=, +=…), comparison (==, ===, !=, <, >…), logical (&& || !).
Database optimization: Often the real bottleneck: slow/unindexed queries, the N+1 problem (one query per item — fix with eager loading). Indexing and optimizing queries often has the most impact.
Organization via includes: Splitting code into logical files (config, functions, header/footer, pages) assembled by includes; a first step toward clean architecture (MVC, autoloading).
All-in-one pack: An install bundling web server + PHP + database: XAMPP (cross-platform), Laragon, WampServer (Windows), MAMP (macOS) — the simplest way to start.
Packagist / ecosystem: The PHP package repository (via Composer): a huge ecosystem of reusable libraries — install proven components instead of coding everything.
Dynamic page: A page generated by the server, often personalized (per user, data); as opposed to an always-identical static HTML page.
Parameters / return: Parameters: input data passed in (with possible default values). Return (via `return`): the result sent back. A function's inputs and outputs.
Common patterns (PHP): Singleton (a single instance, use sparingly), Factory (creating objects), Repository (centralizing data access), Dependency Injection (providing dependencies from outside) — used by frameworks.
PDO: PHP Data Objects: a modern, unified, safe interface for connecting to databases and running queries; works with several database types (abstraction).
PHP: A server-side programming language designed for the Web (PHP: Hypertext Preprocessor); it runs on the server and generates HTML sent to the browser.
phpinfo(): A function displaying PHP configuration information; an info.php file with phpinfo() checks the environment works and shows the installed version.
phpMyAdmin: A web interface (included in packs) for creating and managing MySQL databases without the command line.
Semicolon: Ends each PHP statement (`;`); forgetting it causes a syntax error — the most frequent beginner mistake.
Polymorphism / abstraction: Polymorphism: objects of different classes respond to the same method differently. Abstraction: hiding complexity behind simple interfaces.
OOP / Class / Object: A paradigm organizing code around OBJECTS (data + behavior). A CLASS is a template (properties + methods); an OBJECT is an instance (`new User()`). $this = the current object; __construct = constructor (initialization).
Scope: A variable defined in a function is LOCAL (invisible outside); an outside variable isn't accessible inside the function. Intended isolation — pass data as PARAMETERS.
Profiling / measure before optimizing: Identifying the real bottlenecks by MEASUREMENT (profiling) before optimizing (golden rule); avoid optimizing blindly or prematurely.
Prepared statement: A query with PLACEHOLDERS (? or :name) where data is passed SEPARATELY (prepare then execute); the database treats them as pure data — SQL injection becomes impossible.
require_once / include_once: Ensure a file is included only ONCE (avoids multiple inclusions and redefinitions) — often preferable.
Resources & methods (API): GET /api/products (list), GET /{id} (read), POST (create, 201), PUT/PATCH (update), DELETE (remove); JSON responses with the right codes (200, 201, 400, 401, 404…).
Routing / controllers / Artisan: Routing: mapping URLs to actions (Route::get). Controllers: classes handling requests. Artisan: the command line (generating code, migrations…).
Routing / MVC flow: Routing directs the request to the right controller; flow: request → routing → controller → model (data) → view (display). Separates data, display, coordination.
API security: Secure token authentication, HTTPS (essential — tokens travel over the wire), input validation, authorization (permissions), clean error handling (codes/JSON), rate limiting.
Session security: HASHED passwords (password_hash/verify), regenerating the ID at login (against fixation), secure cookies (HttpOnly/Secure/SameSite), HTTPS, and access control (authorization).
Sessions ($_SESSION): State stored SERVER-SIDE (not modifiable by the user), the browser keeping only a session identifier. session_start() then $_SESSION. The secure mechanism.
SOLID: Five OO design principles: Single Responsibility (one responsibility), Open/Closed (extension without modification), Liskov, Interface Segregation, Dependency Inversion (depend on abstractions).
switch: Compares ONE variable against several values (case), more readable than an elseif chain; `break` exits the switch (forgetting it falls through to the next case); default for other cases.
Symfony: The other major PHP framework (alongside Laravel), known as rigorous, modular, popular in enterprise and large projects; a COMPONENT-based reusable architecture.
Short syntax <?= ?>: Equivalent of `<?php echo ... ?>`: `<?= $variable ?>` displays a variable, handy in HTML templates. Variables are case-sensitive (but keywords aren't).
Associative array: A collection whose items are accessed by a text KEY: `$person = ['name' => 'Alice']; $person['name']`. Ubiquitous (structured data).
Indexed array: A collection whose items are accessed by a numeric INDEX (from 0): `$fruits = ['apple', 'banana']; $fruits[0]`.
Multidimensional array: Arrays INSIDE arrays (e.g. a list of users, each an associative array); represents complex data.
TDD (Test-Driven Development): Writing tests BEFORE the code (the test defines what the code must do, then you write it to make it pass); a discipline improving design.
Ternary: An if/else shortcut returning a value: `condition ? valueIfTrue : valueIfFalse`. Handy for short conditional assignments.
Automated tests / PHPUnit: Code that TESTS your code (re-runnable at will), instead of checking by hand. PHPUnit is PHP's standard testing framework (installed via Composer).
Twig (templates): Symfony's template engine: clean, safe syntax ({{ }}, {% for %}, {% if %}) with automatic escaping (XSS) and inheritance; appreciated beyond Symfony.
Parameter/return typing: Declaring types (`function f(int $a): int`) documents, catches errors and makes code robust — strongly recommended in modern PHP.
Dynamic typing: PHP determines the type from the value (no prior declaration); a variable can change type. Types: string, int, float, bool, array, null, object.
Uploads ($_FILES) — security: User-sent files ($_FILES), to handle carefully: check type/size, RENAME, store outside the root/without PHP execution, limit extensions. A classic source of flaws.
“Falsy” values: Values PHP considers “false” in a condition: false, 0, empty string, '0', null, empty array; the rest is “true”.
Mandatory server-side validation: Client-side validation (JavaScript) improves experience but is bypassable; server-side validation (PHP) is mandatory — it's what really protects.
Validate: Checking data has the expected format (valid email, positive number, required field) and rejecting it otherwise; filter_var() helps (email, URL, integer…).
Variable ($): Stores data; always starts with `$` (`$name`), assigned with `=` (`$age = 30;`). Case-sensitive name, choose it clear and meaningful.
View: Handles DISPLAY: the HTML, what the user sees; receives prepared data and presents it, with no business logic.
while / do...while: while: repeats WHILE a condition is true (unknown count). do...while: runs at least once (test at the end).
XSS → htmlspecialchars: Injecting JavaScript that runs on other users (displaying unescaped data); protection: ESCAPE at display time with htmlspecialchars().