📋 PHP Cheat Sheet

HTML Form → PHP Processing

// HTML form
// <form method="post" action="process.php">
//     <input type="text" name="username">
//     <input type="email" name="email">
//     <button type="submit">Submit</button>
// </form>

// process.php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = $_POST['username'] ?? '';
    $email    = $_POST['email'] ?? '';
}

// GET data (from URL: ?search=php)
$search = $_GET['search'] ?? '';

// Check if form was submitted
if (isset($_POST['submit'])) { ... }

// Sticky form (re-fills values after submission)
// <input value="<?= htmlspecialchars($username) ?>">
                    

// Validation — does the data meet the rules?
filter_var($email, FILTER_VALIDATE_EMAIL);    // false if invalid
filter_var($url, FILTER_VALIDATE_URL);
filter_var($ip, FILTER_VALIDATE_IP);
filter_var($num, FILTER_VALIDATE_INT);

// Sanitization — clean the data
filter_var($str, FILTER_SANITIZE_SPECIAL_CHARS);
filter_var($email, FILTER_SANITIZE_EMAIL);
filter_var($url, FILTER_SANITIZE_URL);
filter_var($num, FILTER_SANITIZE_NUMBER_INT);

// htmlspecialchars — escape for HTML output
htmlspecialchars($input, ENT_QUOTES, 'UTF-8');

// Basic regex validation
preg_match('/^[a-zA-Z0-9_]{3,20}$/', $username);  // 1 if match

// Common validation pattern
$errors = [];
if (empty($name))     $errors[] = "Name is required.";
if (strlen($name) < 2) $errors[] = "Name must be at least 2 characters.";
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    $errors[] = "Invalid email address.";
}
                    

// Simple read/write
$content = file_get_contents("data.txt");
file_put_contents("data.txt", $content);     // Overwrite
file_put_contents("log.txt", $line, FILE_APPEND);  // Append

// Manual file handling
$handle = fopen("data.txt", "r");  // r=read, w=write, a=append
$line = fgets($handle);            // Read one line
$content = fread($handle, 1024);   // Read bytes
fwrite($handle, "Hello\n");
fclose($handle);

// File info
file_exists("data.txt");   // true/false
is_file("data.txt");       // Is it a file (not dir)?
filesize("data.txt");      // Size in bytes
unlink("data.txt");        // Delete file

// Include other PHP files
include "header.php";           // Warning if missing
require "config.php";           // Fatal error if missing
include_once "functions.php";   // Skip if already loaded
require_once "database.php";    // Fatal + skip if loaded

// Reliable path with __DIR__
require __DIR__ . '/includes/config.php';
                    

$_GET        // URL query parameters
$_POST       // Form POST data
$_REQUEST    // GET + POST + COOKIE combined
$_FILES      // Uploaded file information
$_COOKIE     // Cookie values
$_SESSION    // Session data
$_SERVER     // Server & request info
$_ENV        // Environment variables

// Useful $_SERVER values
$_SERVER['REQUEST_METHOD']   // "GET" or "POST"
$_SERVER['SCRIPT_NAME']      // Current script path
$_SERVER['HTTP_HOST']        // Domain name
$_SERVER['REMOTE_ADDR']      // Client IP address
$_SERVER['HTTP_USER_AGENT']  // Browser info
$_SERVER['DOCUMENT_ROOT']    // Web root path
                    

Sessions

// Start session — MUST be first thing on every page
session_start();

// Set session data
$_SESSION['username'] = "Ray";
$_SESSION['role'] = "admin";

// Read session data
echo $_SESSION['username'];

// Check if session key exists
if (isset($_SESSION['username'])) { ... }

// Remove a key
unset($_SESSION['username']);

// Destroy entire session (logout)
session_start();
$_SESSION = [];
session_destroy();

// Regenerate ID (security — after login)
session_regenerate_id(true);
                    

Cookies

// Set a cookie — must be before ANY output
setcookie("theme", "dark", time() + 86400, "/");
// name, value, expires (1 day), path

// Read a cookie (available on NEXT request)
$theme = $_COOKIE['theme'] ?? 'light';

// Delete a cookie — set expiry in the past
setcookie("theme", "", time() - 3600, "/");

// Secure cookie options (PHP 7.3+)
setcookie("token", $value, [
    'expires'  => time() + 86400,
    'path'     => '/',
    'secure'   => true,      // HTTPS only
    'httponly'  => true,      // No JavaScript access
    'samesite' => 'Strict',  // CSRF protection
]);
                    

Classes & Objects

class User {
    // Properties
    public string $name;
    private string $email;
    protected int $age;
    public static int $count = 0;

    // Constructor
    public function __construct(string $name, string $email) {
        $this->name = $name;
        $this->email = $email;
        self::$count++;
    }

    // Method
    public function getEmail(): string {
        return $this->email;
    }

    // Static method
    public static function getCount(): int {
        return self::$count;
    }
}

// Create objects
$user = new User("Ray", "ray@example.com");
echo $user->name;           // Access public property
echo $user->getEmail();     // Access via method
echo User::getCount();      // Call static method
                    

Inheritance, Interfaces & Traits

// Inheritance
class Admin extends User {
    public function __construct(string $name, string $email) {
        parent::__construct($name, $email);
    }

    public function promote(): void { ... }
}

// Abstract class
abstract class Shape {
    abstract public function area(): float;
}

// Interface
interface Printable {
    public function toString(): string;
}

class Circle extends Shape implements Printable {
    public function __construct(private float $radius) {}
    public function area(): float { return M_PI * $this->radius ** 2; }
    public function toString(): string { return "Circle(r={$this->radius})"; }
}

// Trait
trait Timestampable {
    public string $createdAt;
    public function setTimestamp(): void {
        $this->createdAt = date('Y-m-d H:i:s');
    }
}

class Post {
    use Timestampable;
}
                    

// try / catch / finally
try {
    $result = riskyOperation();
} catch (InvalidArgumentException $e) {
    echo "Bad input: " . $e->getMessage();
} catch (Exception $e) {
    echo "Error: " . $e->getMessage();
} finally {
    // Always runs (cleanup)
}

// Throw an exception
throw new Exception("Something went wrong");
throw new InvalidArgumentException("Age must be positive");

// Custom exception
class ValidationException extends Exception {
    private array $errors;
    public function __construct(array $errors) {
        $this->errors = $errors;
        parent::__construct("Validation failed");
    }
    public function getErrors(): array { return $this->errors; }
}

// Error reporting (development)
error_reporting(E_ALL);
ini_set('display_errors', 1);
                    

Connecting

$dsn = "mysql:host=localhost;dbname=mydb;charset=utf8mb4";
$pdo = new PDO($dsn, "username", "password", [
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
    PDO::ATTR_EMULATE_PREPARES   => false,
]);
                    

Prepared Statements (CRUD)

// SELECT (read)
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$id]);
$user = $stmt->fetch();            // One row
$users = $stmt->fetchAll();        // All rows

// Named placeholders
$stmt = $pdo->prepare("SELECT * FROM users WHERE email = :email");
$stmt->execute(['email' => $email]);

// INSERT (create)
$stmt = $pdo->prepare("INSERT INTO users (name, email) VALUES (?, ?)");
$stmt->execute([$name, $email]);
$newId = $pdo->lastInsertId();

// UPDATE
$stmt = $pdo->prepare("UPDATE users SET name = ? WHERE id = ?");
$stmt->execute([$name, $id]);
$affected = $stmt->rowCount();

// DELETE
$stmt = $pdo->prepare("DELETE FROM users WHERE id = ?");
$stmt->execute([$id]);
                    

Transactions

try {
    $pdo->beginTransaction();

    $stmt1 = $pdo->prepare("UPDATE accounts SET balance = balance - ? WHERE id = ?");
    $stmt1->execute([100, $fromId]);

    $stmt2 = $pdo->prepare("UPDATE accounts SET balance = balance + ? WHERE id = ?");
    $stmt2->execute([100, $toId]);

    $pdo->commit();       // All succeed
} catch (Exception $e) {
    $pdo->rollBack();     // All fail — undo everything
    throw $e;
}
                    

Fetch Styles

$stmt->fetch(PDO::FETCH_ASSOC);    // ['name' => 'Ray', ...]
$stmt->fetch(PDO::FETCH_NUM);      // [0 => 'Ray', ...]
$stmt->fetch(PDO::FETCH_OBJ);      // $row->name
$stmt->fetch(PDO::FETCH_BOTH);     // Both assoc + numeric
$stmt->fetchColumn();              // Single column value
$stmt->fetchAll(PDO::FETCH_ASSOC); // Array of all rows
                    

Quick Security Checklist

// 1. SQL Injection — ALWAYS use prepared statements
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$id]);
// NEVER: "SELECT * FROM users WHERE id = $id"

// 2. XSS — ALWAYS escape output
echo htmlspecialchars($userInput, ENT_QUOTES, 'UTF-8');

// 3. CSRF — use tokens in forms
// Generate:
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
// In form: <input type="hidden" name="csrf_token"
//   value="<?= $_SESSION['csrf_token'] ?>">
// Verify:
if (!hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
    die("Invalid CSRF token");
}

// 4. Passwords — hash, never store plain text
$hash = password_hash($password, PASSWORD_DEFAULT);
// Verify:
if (password_verify($inputPassword, $storedHash)) {
    echo "Login successful!";
}

// 5. File uploads — validate type and size
$allowed = ['image/jpeg', 'image/png', 'image/gif'];
if (!in_array($_FILES['file']['type'], $allowed)) {
    die("Invalid file type");
}