PHP
Syntax
PHP executes statements inside PHP tags; statements end with semicolons.
QUICK LOOKUP / PRACTICAL PATTERNS
Reference library
Exact syntax. Short explanations. Common pitfalls.
Start with the assessment workflow →
150 references
PHP
Types
PHP has scalar, compound, and special types.
PHP
Variables
Variables begin with $ and can hold different values over time.
PHP
Arrays
Arrays are ordered key/value maps.
PHP
Filtering and sorting
Filter selects values; sorting changes their order.
PHP
Strings
Strings contain bytes; concatenation uses a dot.
PHP
Functions
Functions give a named operation explicit inputs and a return value.
PHP
Classes
Classes combine behavior with state.
PHP
Interfaces
An interface defines a contract that implementations must satisfy.
PHP
Traits
Traits reuse method implementations across classes.
PHP
Enums
Enums define a closed set of named values.
PHP
Constructors
A constructor initializes an object; promotion declares and assigns properties.
PHP
Visibility
public, protected, and private control access to members.
PHP
Static
Static members belong to the class rather than an instance.
PHP
Exceptions
Exceptions interrupt execution until caught; Throwable covers Error and Exception.
PHP
Namespaces
Namespaces avoid name collisions and organize symbols.
PHP
Closures
Closures are anonymous functions that can capture outer values.
PHP
Anonymous functions
Arrow functions express one expression and capture outer variables by value.
PHP
Type declarations
Parameter, property, and return types express allowed values.
PHP
Null handling
?? supplies a default for absent/null values; ?-> stops a chain on null.
PHP
Match expressions
match returns a value using strict comparisons.
PHP
Common standard-library functions
Standard functions handle common collection, JSON, date, and validation tasks.
PHP
PDO prepared statements
PDO provides parameterized database access in plain PHP.
Laravel
Project structure
Laravel separates routes, HTTP handling, models, views, and database changes.
Laravel
Artisan
Artisan is Laravel’s command-line interface.
Laravel
Routes
Routes map HTTP methods and paths to handlers.
Laravel
Controllers
Controllers coordinate HTTP input, application actions, and responses.
Laravel
Requests
Request provides input, headers, files, and authenticated identity.
Laravel
Form Requests
A Form Request packages authorization and validation.
Laravel
Validation
Validation checks input shape, bounds, and allowed values.
Laravel
Models
An Eloquent model maps a table to application behavior.
Laravel
Eloquent
Eloquent offers model-based query and persistence methods.
Laravel
Relationships
Relationships describe model associations.
Laravel
Query Builder
The query builder builds parameterized SQL without full models.
Laravel
Migrations
Migrations version database schema changes.
Laravel
Seeders
Seeders insert known initial or development data.
Laravel
Factories
Factories create variable test fixtures.
Laravel
Transactions
A transaction groups changes into an atomic database unit.
Laravel
Middleware
Middleware inspects requests before/after the handler.
Laravel
Authentication
Authentication establishes who is making the request.
Laravel
Authorization
Authorization decides whether the actor may perform this operation.
Laravel
Policies
Policies group authorization rules for a model.
Laravel
Dependency injection
Laravel’s container supplies concrete constructor or method dependencies.
Laravel
Service classes
A service holds a cohesive business operation outside HTTP concerns.
Laravel
Configuration
Configuration centralizes application settings.
Laravel
Environment variables
Environment files provide deployment-specific settings.
Laravel
Logging
Logging records diagnostic events with useful context.
Laravel
Exceptions
Laravel translates uncaught exceptions into HTTP responses.
Laravel
API resources
Resources define explicit serialization independent of storage.
Laravel
API responses
Responses contain a status, headers, and a body.
Laravel
JSON
Laravel JSON responses set the content type and encode data.
Laravel
Pagination
Pagination bounds query results and supports navigation.
Laravel
Queues
Queues run deferred work outside the request.
Laravel
Caching
Caching reuses derived data for a bounded time.
Laravel
Testing
Feature tests exercise HTTP and persistence; unit tests isolate rules.
SQL
SELECT
SELECT projects columns from rows.
SQL
INSERT
INSERT creates rows.
SQL
UPDATE
UPDATE changes matching rows.
SQL
DELETE
DELETE removes matching rows.
SQL
WHERE
WHERE filters individual rows before grouping.
SQL
JOIN
JOIN combines rows using related keys.
SQL
GROUP BY
GROUP BY collects rows for aggregate calculations.
SQL
ORDER BY
ORDER BY defines result ordering.
SQL
LIMIT
LIMIT bounds rows returned.
SQL
Aggregation
Aggregates compute count, sum, min, max, or average.
SQL
Subqueries
A subquery nests a query inside another query.
SQL
Constraints
Constraints enforce integrity independently of application code.
SQL
Primary keys
A primary key uniquely identifies a row.
SQL
Foreign keys
Foreign keys require referenced records to exist.
SQL
Unique constraints
Unique constraints prevent duplicate keys at the database boundary.
SQL
Indexes
Indexes accelerate selected reads at a write/storage cost.
SQL
Transactions
Transactions commit or roll back a set of writes.
SQL
Isolation
Isolation controls how concurrent transactions observe/interfere with each other.
SQL
ACID
ACID means atomicity, consistency, isolation, and durability.
HTTP / API
HTTP methods
Methods communicate the operation’s intended semantics.
HTTP / API
Status codes
Status codes summarize the HTTP outcome.
HTTP / API
Request/response structure
HTTP messages carry headers and an optional body.
HTTP / API
REST
REST-style interfaces use resource URLs and HTTP semantics.
HTTP / API
JSON
JSON is a text format for structured data.
HTTP / API
Authentication
API authentication establishes an actor from trusted credentials.
HTTP / API
Authorization
API authorization restricts records and operations for the actor.
HTTP / API
Pagination
Paginated APIs return bounded data and navigation information.
HTTP / API
Error responses
A predictable error envelope helps clients handle failure safely.
HTTP / API
Idempotency
Idempotency means repeating an operation has the same intended effect.
HTTP / API
Validation
API validation rejects malformed shape and invalid fields.
Security
Input validation
Validation constrains data shape, ranges, and allowed values.
Security
SQL injection
Injection happens when input changes SQL structure instead of remaining data.
Security
Cross-site scripting (XSS)
XSS lets attacker-controlled text execute as script in a browser.
Security
Cross-site request forgery (CSRF)
CSRF exploits browser credentials on unwanted cross-site mutations.
Security
Authentication versus authorization
Authentication identifies the actor; authorization determines permitted actions.
Security
Authentication
Secure authentication verifies credentials and manages sessions safely.
Security
Authorization and RBAC
RBAC assigns capabilities via roles, combined with resource scope.
Security
Password hashing
Password hashes allow verification without storing plaintext.
Security
Sessions
Sessions associate a browser with authenticated server-side state.
Security
Rate limiting
Rate limits bound abusive request frequency.
Security
Mass assignment
Mass assignment writes many model attributes from an array.
Security
Secure headers
Response headers can reduce browser-side exposure.
Security
Secrets management
Secrets include credentials, tokens, and encryption keys.
Security
Logging
Security logs record relevant events without unnecessary sensitive data.
Security
Audit trails
Audit records document who did what, when, and to which entity.
Security
Least privilege
Least privilege grants only the access necessary for a task.
Security
Secure error handling
Safe errors reveal useful client information without internal details.
Security
File upload security
Uploads introduce untrusted bytes, names, and storage paths.
Security
ISO/IEC 27001 context
ISO/IEC 27001 concerns an organizational information security management system.
Engineering
Requirements analysis
Requirements describe outcomes, rules, and constraints.
Engineering
Domain modelling
Domain models name business concepts and their behavior.
Engineering
Entity modelling
Entities have stable identity through changing attributes.
Engineering
Database design
Schema design makes relationships and integrity explicit.
Engineering
Architecture
Architecture organizes responsibilities and dependencies.
Engineering
Separation of concerns
Separate HTTP, business rules, storage, and presentation responsibilities.
Engineering
SOLID principles
SOLID encourages cohesive responsibilities and replaceable collaborators.
Engineering
Error handling
Error handling distinguishes invalid input, conflicts, and unexpected failure.
Engineering
Logging
Logs explain execution and failure in operational terms.
Engineering
Testing
Tests prove requirements, invariants, and failure behavior.
Engineering
Concurrency
Concurrency means operations overlap and can act on stale state.
Engineering
Transactions
A transaction boundary defines which database changes succeed together.
Engineering
Reliability
Reliability means preserving correct outcomes despite expected failures.
Engineering
Observability
Observability uses logs, metrics, and traces to explain system behavior.
Assessment Methodology
01. Read requirements
Restate requested outcomes. Mark must-have behavior and acceptance criteria.
Assessment Methodology
02. Identify actors
List who interacts with the system: customer, administrator, operator, external provider.
Assessment Methodology
03. Identify use cases
Write actor + action + outcome. Cover reads and mutations, not only creation.
Assessment Methodology
04. Identify entities
Name persistent identities and value objects; describe relationships.
Assessment Methodology
05. Extract business rules
Turn prose into invariants: bounds, ownership, valid states, currency, duplicate behavior.
Assessment Methodology
06. Identify constraints
Record time, language, database, offline requirements, scale, and forbidden dependencies.
Assessment Methodology
07. Design data model
Choose primary/foreign keys, nullability, uniqueness, indexes, retention, and amounts.
Assessment Methodology
08. Design API / interfaces
Define input, output, status codes, authorization, and errors for each use case.
Assessment Methodology
09. Design architecture
Use routes, controllers, models, and focused services only when warranted.
Assessment Methodology
10. Identify security requirements
Check validation, identity, permissions, encoding, secrets, audit needs, and least privilege.
Assessment Methodology
11. Identify failure cases
List missing records, invalid state, insufficient funds, duplicates, database failures, and unknown outcomes.
Assessment Methodology
12. Implement smallest correct version
Complete one vertical path with validation, persistence, response, and tests before extras.
Assessment Methodology
13. Test happy paths
Prove each acceptance criterion with realistic data and expected persisted results.
Assessment Methodology
14. Test edge cases
Check zero, negative, maximum, missing, malformed, unauthorized, duplicate, and concurrent inputs.
Assessment Methodology
15. Review security
Recheck every mutation and read boundary; inspect raw SQL, mass assignment, errors, and logs.
Assessment Methodology
16. Review maintainability
Check naming, responsibilities, duplication, configuration, and whether the next reader can follow the flow.
Assessment Methodology
17. Explain trade-offs
State assumptions, choices, limitations, alternatives, and what you would change with more time.
Financial-system patterns
Monetary values
Integer minor units avoid common binary floating-point representation errors.
Financial-system patterns
Transaction states
Explicit states distinguish pending, successful, failed, and unknown outcomes.
Financial-system patterns
Atomic operations
Atomic operations either apply completely or have no effect.
Financial-system patterns
Database transactions
Database transactions group related local financial writes.
Financial-system patterns
Idempotency
Persisted idempotency prevents a repeated logical request from producing a second effect.
Financial-system patterns
Duplicate requests
Duplicate handling defines behavior when the same action arrives again.
Financial-system patterns
Audit trails
Financial audit records should explain state changes with actor and correlation data.
Financial-system patterns
Immutable records
Immutable financial history is amended with new compensating records.
Financial-system patterns
Reconciliation
Reconciliation compares independent records and surfaces discrepancies.
Financial-system patterns
Authorization
Financial authorization checks ownership, capabilities, limits, and separation of duties.
Financial-system patterns
Concurrency
Concurrent financial operations can both act on an old balance.
Financial-system patterns
Optimistic locking
Optimistic locking updates only if a version has not changed.
Financial-system patterns
Pessimistic locking
Pessimistic locking holds database locks while checking and changing state.
Financial-system patterns
Consistency
Consistency preserves invariants across records and systems.
Financial-system patterns
Failure handling
Financial failure handling distinguishes rejected, failed, and unknown outcomes.