PHP Cheat Sheet

PHP Tags & Output

Data Types

Type Juggling & Casting

Falsy Values ⭐

Variables

Constants

Variable Scope

String Interpolation

Operator Reference 🔥

Spaceship & Null Coalescing

if / elseif / else

match Expression (PHP 8) ⭐

switch

Loops

Function Declarations & Type Hints 🔥

Closures (Anonymous Functions)

Arrow Functions (PHP 7.4+) ⭐

First-class Callables (PHP 8.1)

Named Arguments (PHP 8.0) ⭐

Array Creation

Add / Remove

Search & Check

Sort Functions

Functional Array Methods 🔥

Destructuring

String Functions Reference 🔥

sprintf Format Specifiers

Password Security ⭐

Complete Class Reference 🔥

Inheritance

Interfaces & Traits

Enums (PHP 8.1) ⭐

PHP 8.x Feature Matrix 🔥

Attributes (PHP 8.0)

Fibers (PHP 8.1)

try / catch / finally

Exception Hierarchy

Throwable — top interface (PHP 7+)
Error — engine errors (TypeError, ParseError, ArithmeticError…)
Exception — user exceptions
RuntimeException — during execution
LogicException — programming mistakes
InvalidArgumentException
BadMethodCallException
OverflowException

Error Levels & Handlers

Read & Write

Filesystem Functions

CSV & JSON Files

PDO Connection & Queries 🔥

Fetch Modes

SQL Injection Prevention

❌ Never interpolate user input into SQL strings

Superglobals Reference 🔥

Form Input Handling

File Uploads

CSRF Protection

Sessions

date() Format Codes

DateTime OOP (preferred) ⭐

Regex Functions

Pattern Quick Reference

Composer CLI

composer.json

Namespaces (PSR-4)

Version Constraints

Most Used Built-in Functions 🔥

Classic PHP Gotchas ⭐

Loose comparisons — <code>0 == "foo"</code> is <code>false</code> in PHP 8 but was <code>true</code> in PHP 7. Always use <code>===</code>.
array_filter keys — preserves original keys! Always follow with <code>array_values()</code> if you need re-indexed.
foreach by value — copies the array; use <code>&$val</code> to modify in place.
Headers must come first — <code>header()</code>, <code>setcookie()</code>, <code>session_start()</code> must be before any output.
strpos returns 0 — if needle is at position 0, result is <code>0</code> (falsy!). Use <code>=== false</code> check.
Type juggling in switch — switch uses loose <code>==</code>; use <code>match</code> for strict comparison.
Integer division — <code>7 / 2 = 3.5</code> (float). Use <code>intdiv(7,2)</code> or cast <code>(int)(7/2)</code>.
References in loops — after <code>foreach ($arr as &$v)</code>, <code>unset($v)</code> after the loop or the last element gets corrupted.
Null vs empty — <code>isset()</code> returns false for null; <code>empty()</code> returns true for 0, "", "0", [], null.
Date timezone — always set <code>date_default_timezone_set('Asia/Kolkata')</code> or in php.ini.
String functions are not MB-safe — use <code>mb_*</code> variants (mb_strlen, mb_substr) for Unicode.

Security Checklist ⭐

Always use prepared statements — never interpolate user data into SQL
Escape output with htmlspecialchars() — prevents XSS
Use password_hash / password_verify — never md5/sha1 for passwords
Validate file uploads with finfo (real MIME) — not <code>$_FILES['type']</code>
Set httponly + secure + samesite flags on all cookies
session_regenerate_id(true) after login — prevent session fixation
Use random_bytes / random_int — not rand() for security tokens
Validate & sanitize ALL $_GET / $_POST input with filter_var
Implement CSRF tokens in all state-changing forms
Never expose error details to users — log them server-side