Given `$a = '0'; $b = false;`, what does `var_dump($a == $b)` output, and why?
- A. bool(true), because the string '0' is loosely equal to false ✓
- B. bool(false), because a string and a boolean are never comparable
- C. bool(true), because any non-empty string equals false
- D. bool(false), because '0' is a truthy string
Correct answer: A. The string '0' is one of PHP's falsy values, so with loose comparison ('==') it equals false, yielding true.
Which PDO practice most effectively prevents SQL injection when inserting user-supplied data?
- A. Escaping the input with addslashes() before concatenating it into the query
- B. Using prepared statements with bound parameters via placeholders ✓
- C. Wrapping the query inside a try/catch block
- D. Setting PDO::ATTR_ERRMODE to PDO::ERRMODE_EXCEPTION
Correct answer: B. Prepared statements with bound parameters separate SQL code from data, which is the correct defense against SQL injection.
In PHP, what is the practical difference between `require` and `include`?
- A. require caches the file, while include re-reads it on every call
- B. require only works for classes, while include works for any file
- C. On failure to find the file, require raises a fatal error and halts, while include only emits a warning and continues ✓
- D. There is no difference; they are exact aliases
Correct answer: C. A failed require produces a fatal E_COMPILE_ERROR and stops the script, whereas a failed include emits an E_WARNING and execution continues.
You want to store a user's password in the database. Which approach is correct in modern PHP?
- A. Hash it with md5() before storing
- B. Encrypt it with a symmetric key using openssl_encrypt()
- C. Use password_hash() to store and password_verify() to check ✓
- D. Store it as-is but only over an HTTPS connection
Correct answer: C. password_hash() (bcrypt/argon2 by default) with password_verify() is the standard, salted, slow-hash approach for password storage.
What does the `===` operator do that `==` does not?
- A. It compares both value and type without type juggling ✓
- B. It compares object references instead of object contents
- C. It performs a case-insensitive string comparison
- D. It automatically casts both operands to strings first
Correct answer: A. The identity operator '===' requires both the value and the type to match, avoiding the type coercion that '==' performs.
In a Composer project, what is the primary purpose of the `composer.lock` file?
- A. It lists the minimum PHP version required to run the project
- B. It records the exact installed versions of dependencies so installs are reproducible ✓
- C. It stores encrypted credentials for private package repositories
- D. It defines PSR-4 autoloading namespace mappings
Correct answer: B. composer.lock pins the exact resolved dependency versions, so `composer install` reproduces an identical dependency set across environments.
A form is submitted with `method="post"`. In the PHP script, which superglobal reliably contains the submitted field values?
- A. $_GET
- B. $_REQUEST only
- C. $_POST ✓
- D. $_SERVER
Correct answer: C. Values sent via an HTTP POST body are populated into the $_POST superglobal.
What is the correct way to iterate over an associative array while accessing both keys and values?
- A. for ($i = 0; $i < count($arr); $i++) { echo $arr[$i]; }
- B. foreach ($arr as $key => $value) { echo "$key: $value"; } ✓
- C. while (list($value) = each($arr)) { echo $value; }
- D. foreach ($arr as $value => $key) { echo "$key: $value"; }
Correct answer: B. The `foreach ($arr as $key => $value)` syntax is the standard way to access both keys and values of an associative array.
Your PHP script returns a blank white page in production but works on your machine. What is the most appropriate first step to diagnose it?
- A. Increase memory_limit in php.ini to the maximum
- B. Restart the web server to clear the opcode cache
- C. Check the PHP error log (or temporarily enable display_errors in dev) to find the fatal error ✓
- D. Switch the database from MySQL to PostgreSQL
Correct answer: C. A blank page typically means a fatal error with display_errors off; the error log reveals the actual cause, which is the correct first diagnostic step.
What does the following return: `array_map(fn($n) => $n * 2, [1, 2, 3])`?
- A. [2, 4, 6] ✓
- B. 12
- C. [1, 2, 3, 2, 4, 6]
- D. 6
Correct answer: A. array_map applies the callback to each element, returning a new array [2, 4, 6].
What is the key difference between include and require?
- A. require is always faster
- B. On a missing file, require raises a fatal error while include emits a warning and continues ✓
- C. include cannot be used twice
- D. require ignores return values
Correct answer: B. require halts execution on failure; include only warns and proceeds.
In PHP 8, the expression 0 == "abc" evaluates to:
- A. true
- B. false ✓
- C. null
- D. a TypeError
Correct answer: B. PHP 8 compares a number and non-numeric string as strings, so this is false.
PDO prepared statements primarily protect against:
- A. Cross-site scripting
- B. SQL injection ✓
- C. CSRF
- D. Session fixation
Correct answer: B. Bound parameters separate SQL from data, neutralizing injection.
Which visibility allows a property to be used by the class and its subclasses but not from outside?
- A. public
- B. private
- C. protected ✓
- D. final
Correct answer: C. protected members are accessible within the class hierarchy but not externally.
Declaring a method as static means it:
- A. Can only be called once
- B. Belongs to the class and can be called without an instance ✓
- C. Cannot return a value
- D. Is automatically thread-safe
Correct answer: B. Static methods are invoked on the class itself, needing no object instance.
Which PSR standard defines the namespace-to-directory autoloading commonly used by Composer?
- A. PSR-1
- B. PSR-4 ✓
- C. PSR-7
- D. PSR-12
Correct answer: B. PSR-4 specifies autoloading by mapping namespaces to directory paths.
What does (int)"12abc" produce in PHP?
- A. 0
- B. 12 ✓
- C. A TypeError
- D. null
Correct answer: B. Casting parses leading numeric characters, yielding 12.
The spaceship operator <=> returns:
- A. Only true or false
- B. -1, 0, or 1 depending on the comparison ✓
- C. The larger of the two values
- D. A bitwise result
Correct answer: B. It returns a signed integer indicating less-than, equal, or greater-than.
Which statement about PHP sessions is correct?
- A. session_start() must be called after output is sent
- B. Session data is stored client-side in a cookie by default
- C. session_start() must be called before any output is sent ✓
- D. Sessions cannot store arrays
Correct answer: C. session_start() sends headers, so it must run before any output.
A PHP closure captures outer-scope variables using:
- A. the global keyword automatically
- B. the use keyword in its definition ✓
- C. the static keyword only
- D. import statements
Correct answer: B. Closures inherit variables from the parent scope via the use clause.
What is the key behavioral difference between require and include?
- A. They are identical
- B. include is always faster
- C. require raises a fatal error if the file is missing, while include raises only a warning ✓
- D. include caches the file but require does not
Correct answer: C. A failed require halts the script with a fatal error; a failed include only warns and continues.
Using PDO prepared statements primarily protects against which attack?
- A. Cross-site scripting
- B. SQL injection ✓
- C. CSRF
- D. Clickjacking
Correct answer: B. Bound parameters keep user input separate from SQL code, preventing injection.
In PHP 8, what does var_dump(0 == "a") output?
- A. true
- B. false ✓
- C. null
- D. a fatal error
Correct answer: B. PHP 8 compares a number to a non-numeric string as strings, so "0" == "a" is false (changed from PHP 7).
Which visibility keyword restricts a property to access only within its own class?
- A. public
- B. protected
- C. private ✓
- D. static
Correct answer: C. private members are inaccessible from subclasses or outside code; protected allows subclass access.
What does the spaceship operator <=> return?
- A. Boolean true or false
- B. -1, 0, or 1 depending on the comparison ✓
- C. The larger of the two values
- D. Null on type mismatch
Correct answer: B. <=> returns an integer -1, 0, or 1, useful for sort comparison callbacks.
What is the standard mechanism for handling a thrown exception in PHP?
- A. error_reporting()
- B. A try/catch block ✓
- C. if/else on an error code
- D. trigger_error()
Correct answer: B. Exceptions are caught by wrapping risky code in try and handling it in catch.
What does array_map($fn, $arr) return?
- A. The original array modified in place
- B. A single reduced value
- C. A new array with the callback applied to each element ✓
- D. A boolean
Correct answer: C. array_map applies the callback to every element and returns a new array of results.
In Composer, which file pins the exact resolved versions of dependencies?
- A. packagist.json
- B. composer.json
- C. composer.lock ✓
- D. vendor/autoload.php
Correct answer: C. composer.lock records the exact installed versions so installs are reproducible.
Why is password_hash() preferred over md5() for storing passwords?
- A. It is faster to compute
- B. It produces shorter output
- C. It uses a salted, slow, adaptive algorithm like bcrypt or argon2 ✓
- D. It is reversible for recovery
Correct answer: C. password_hash() auto-salts and uses a deliberately slow adaptive algorithm, resisting brute-force attacks.
What does the nullsafe operator $obj?->method() do?
- A. Throws if $obj is null
- B. Calls the method twice
- C. Returns null instead of erroring when $obj is null ✓
- D. Casts $obj to boolean
Correct answer: C. The nullsafe operator short-circuits to null if the left operand is null instead of raising an error.