Introduction to PHP

PHP is a language for building web pages on the server. When someone visits a PHP page, the server runs your code, produces HTML, and sends that HTML to the browser — which never sees the PHP at all. That one sentence explains most of what makes PHP different from JavaScript, and it is the right place to start.

What happens when someone visits a PHP page#

1. The browser requests index.php.
2. The web server sees the .php extension and hands the file to PHP.
3. PHP runs the code, which may query a database or read files.
4. PHP produces HTML.
5. The server sends that HTML back. The browser receives ordinary HTML.

View source on a PHP page and you will not see any PHP. It has already run and finished. That is the fundamental difference from JavaScript, which is sent to the browser and runs there.

Your first script#

<?php
$name = "Ana";
$hour = (int) date("G");
$greeting = $hour < 12 ? "Good morning" : "Good afternoon";
?>
<!doctype html>
<html lang="en">
<body>
  <h1><?= htmlspecialchars($greeting) ?>, <?= htmlspecialchars($name) ?></h1>
</body>
</html>

Run it with PHP’s built-in server:

php -S localhost:8000

Then open http://localhost:8000. No Apache, no configuration — enough for learning and local development.

<?= is shorthand for <?php echo. Note the htmlspecialchars around every value: that is what stops user-supplied text being interpreted as HTML, and it is a habit worth forming from your very first script.

The syntax#

<?php
// Variables always start with a dollar sign
$name = "Ana";
$age = 34;
$price = 12.99;
$isActive = true;
$nothing = null;

// Strings: double quotes interpolate, single quotes do not
echo "Hello $name";        // Hello Ana
echo 'Hello $name';        // Hello $name
echo "Total: {$price}";    // braces for clarity

// Concatenation uses a dot, not a plus
echo "Hello " . $name;

The dot for concatenation is the detail that catches people arriving from JavaScript or Python. "a" + "b" in PHP does not join strings.

Arrays#

<?php
$fruits = ["apple", "pear", "plum"];
echo $fruits[0];
echo count($fruits);

// Associative array - the workhorse of PHP
$person = [
    "name" => "Ana",
    "age"  => 34,
];

echo $person["name"];

foreach ($fruits as $fruit) {
    echo $fruit;
}

foreach ($person as $key => $value) {
    echo "$key: $value";
}

PHP has one array type that serves as both a list and a dictionary, which is unusual and very convenient.

Conditions and loops#

<?php
if ($score >= 80) {
    $grade = "A";
} elseif ($score >= 70) {
    $grade = "B";
} else {
    $grade = "F";
}

for ($i = 0; $i < 5; $i++) { echo $i; }

while ($n < 10) { $n++; }

// Alternative syntax, for mixing with HTML
if ($loggedIn): ?>
  <p>Welcome back</p>
<?php else: ?>
  <p>Please sign in</p>
<?php endif;

That last form is worth knowing. Inside templates it is far easier to read than braces scattered between HTML tags.

Functions#

<?php
function greet(string $name, string $greeting = "Hello"): string
{
    return "$greeting, $name!";
}

echo greet("Ana");
echo greet("Ana", "Good morning");

The type declarations are optional but strongly recommended. Add this at the top of each file and PHP enforces them strictly rather than converting silently:

<?php
declare(strict_types=1);

Superglobals#

PHP gives you a set of arrays that are available everywhere:

<?php
$_GET      // values from the query string
$_POST     // values from a submitted form
$_SESSION  // per-visitor storage across requests
$_COOKIE   // cookies sent by the browser
$_FILES    // uploaded files
$_SERVER   // request and server information

<?php
if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $email = trim($_POST["email"] ?? "");

    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        $error = "That does not look like an email address.";
    }
}

Sessions#

<?php
session_start();          // must come before any output

$_SESSION["user_id"] = 42;

if (isset($_SESSION["user_id"])) {
    echo "Signed in";
}

session_destroy();

HTTP forgets you between requests. Sessions are how a site remembers that you are logged in.

Databases#

<?php
$pdo = new PDO("mysql:host=localhost;dbname=shop;charset=utf8mb4", $user, $pass, [
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
]);

$stmt = $pdo->prepare("SELECT id, name FROM products WHERE price < ?");
$stmt->execute([20]);

foreach ($stmt as $row) {
    echo htmlspecialchars($row["name"]);
}

Use prepared statements from the very beginning. Building SQL by pasting variables into a string is the single most exploited mistake in PHP.

What PHP is used for#

A very large share of the web runs on it: WordPress, Drupal, Magento and a great many custom applications. Laravel and Symfony are mature, well-designed frameworks that handle routing, templating, database access and security for you.

The language’s poor reputation dates from PHP 4 and 5, which had inconsistent function names and unsafe defaults. Modern PHP has strict types, proper exceptions, an excellent package manager in Composer, and performance several times better than a decade ago. Much of the criticism you will read online is describing a version nobody should still be running.

Where to go next#

• PHP basics — the syntax in more depth.
• Working with forms in PHP — the next thing you will build.
• PHP security best practices — read this early, not late.