use captures by value — what does the following code print? $count = 0; $inc = function () use ($count) { return $count + 1; }; $count = 10; echo $inc();

1 — the closure captured the value at definition time

11 — a closure always reads the outer variable's newest value

An error because $count is reassigned after the closure captured it

An "undefined variable" warning because the closure cannot see $count

What is the most serious problem in this code? $id = $_GET['id']; $stmt = $pdo->query("SELECT * FROM users WHERE id = " . $id);

Missing HTML escaping, so it is vulnerable to XSS when the result is displayed

SQL injection — the input is concatenated straight into the SQL

A syntax error because query() does not accept a concatenated string

Only dangerous when the id is a string; a numeric id is safe

The posts table has 100 rows. How many queries does this code run? $posts = Post::all(); foreach ($posts as $post) { echo $post->author->name; }

101 — one query for the posts plus one per post for the author

1 — Eloquent joins the authors table automatically

2 — Eloquent eager loads the relation on first access

200 — each post needs one query for the post and one for the author

PHP quiz — 38 questions with answers

Beginner level — 12 PHP questions

Question 1Types

In PHP, how does `==` differ from `===`?

A.== only works for numbers while === works for every type
B.== compares values while === compares the variables' memory addresses
C.=== compares both type and value with no coercion
D.=== is slower than == because it also compares the type

Answer: C

== type-juggles both sides to the same type before comparing, so '1' == '01' is true. === requires the same type and the same value, with no juggling — '1' === '01' is false. Default to === to avoid surprises.

References

PHP docs — Comparison operators

Question 2Core

What does `$b = &$a` do?

A.It creates a read-only copy of $a, so writing to $b errors
B.Both variables point at one value — changing either shows in the other
C.It copies $a's value into $b but faster than a normal assignment
D.It takes $a's memory address into $b like a C pointer

Answer: B

It creates a reference: $a and $b are two names for the same value, so a change through either is visible in the other. Unlike normal assignment (copy for arrays, handle for objects), a reference is a true alias — even reassigning $b = 5 also changes $a.

References

PHP docs — References explained

Question 3Core

Given `$name = $_GET['name'] ?? 'guest';` — how does the `??` operator behave?

A.It returns the right side when the left is null or does not exist, with no error
B.It returns the right side for any falsy left side, including 0 and an empty string
C.It is equivalent to empty() — returning the right side when the value is empty or zero
D.It warns about an undefined index if the name key is missing before returning the right side

Answer: A

?? (null coalescing) returns the right side when the left side is null or does not exist, without raising a warning. '0' and '' are kept as-is — unlike ?: and empty(), which treat them as "empty". Distinguish: isset() = exists and is not null; empty() = falsy (including 0, '0', '', [], null).

References

PHP docs — Null coalescing operator

Question 4Errors

Since PHP 7, how are `Error` and `Exception` related?

A.Error extends Exception so catch (Exception $e) catches both
B.Exception was fully replaced by Error in PHP 7
C.Both implement the Throwable interface and can be caught together with Throwable
D.Error cannot be caught, so the program always stops

Answer: C

They are two separate branches that both implement the Throwable interface. Error represents engine-level faults (TypeError, ParseError, DivisionByZeroError) — fatal, uncatchable errors before PHP 7. Exception is for application-level errors. catch (Throwable $t) catches both; catch (Exception $e) does not catch Error.

References

PHP docs — Errors in PHP 7

Question 5OOP

When does PHP invoke a class's `__get()` magic method?

A.Every time any property is read, including existing public ones
B.When calling a method that does not exist on the object
C.When reading a property that does not exist or is not accessible from outside
D.When the object is passed to var_dump or print_r

Answer: C

__get($name) is invoked when code reads a non-existent or inaccessible property (private/protected seen from outside). Similarly: __set for assignment, __call($name, $args) for non-existent methods, __callStatic for static methods. An existing public property is read directly, without going through a magic method.

References

PHP docs — Magic methods

Question 6Core· select all that apply

Which statements about `match` (PHP 8) compared to `switch` are true?

A.It allows falling through to the branch below when a branch is left empty
B.It is an expression — you can assign directly with $x = match(...) {...}
C.You must write break at the end of each branch to stop it running on
D.It compares strictly (===) with no coercion like switch
E.It throws UnhandledMatchError when nothing matches and there is no default

Answer: B, D, E

match differs from switch in three main points: (1) it compares with strict ===, no type coercion; (2) it is an expression — it returns a value, can be assigned directly, and needs no break; (3) if no branch matches and there is no default, it throws UnhandledMatchError instead of silently falling through. There is no fall-through — multiple conditions sharing a result are listed with commas.

References

PHP docs — match

Question 7Web

How does a PHP session maintain login state across requests?

A.The server stores the data by session ID and the browser returns the ID in a cookie
B.The server identifies the user by their IP address
C.The browser stores the data in localStorage and sends it with each request
D.All the session data is stored in a cookie and sent with each request

Answer: A

The server generates a random session ID and sends it to the browser via a cookie. On each subsequent request the browser sends that cookie back; the server uses the ID to look up session data stored on its side (file, Redis, DB). Sensitive data never leaves the server — only the ID travels.

References

PHP docs — Session introduction

Question 8Security

Why store passwords with password_hash() instead of md5()?

A.md5() cannot handle long passwords or special characters
B.password_hash() is reversible so the original can be recovered when needed
C.md5() was removed from recent PHP versions
D.A deliberately slow algorithm with a salt — resisting brute force and rainbow tables

Answer: D

md5 was designed to be fast — modern GPUs try billions of hashes per second — and without a salt it's trivially reversed with rainbow tables. password_hash() uses bcrypt/argon2: deliberately slow (adjustable cost) and it generates a random salt per password. Verify with password_verify().

References

PHP docs — password_hash

Question 9Laravel Core

Route `/users/{user}` points to a controller receiving `User $user`. How does Laravel handle it?

A.It creates a new User instance with the id from the URL without querying
B.It finds the User by the id in the URL and returns 404 when it does not exist
C.It passes the raw id string and the developer calls find() in the controller
D.It queries the User by id and throws a 500 when not found

Answer: B

Route model binding: Laravel sees the segment name {user} matching the type-hinted parameter User $user, runs User::findOrFail($id) itself, and injects the model into the controller. Not found → it returns 404 automatically and the controller never runs. This replaces the repeated find + null check in every action.

References

Laravel docs — Route Model Binding

Question 10Laravel Core

Why use migrations instead of altering the database schema directly?

A.The production database does not allow running ALTER TABLE directly
B.Migrations make queries run faster through automatic index optimization
C.The schema becomes versioned code — every environment applies the same change
D.Migrations back the data up automatically before each schema change

Answer: C

Migrations turn schema changes into versioned code in git. Each change is an ordered file; php artisan migrate applies the files that haven't run yet — so a new dev machine, staging, and production all build the exact same schema. Manual edits in the DB leave no record of what changed, let environments drift apart, and can't be reproduced.

References

Laravel docs — Migrations

Question 11Queues

After a user signs up, the system sends a welcome email. Why dispatch the email to a queue instead of sending it inside the request?

A.The queue encrypts the email content so it is safer
B.Email sent through a queue has a higher inbox rate
C.Laravel requires every Mailable to go through a queue
D.The request returns immediately while the slow work runs in a background worker

Answer: D

Calling SMTP can take seconds and can fail — making the user wait inside the request is wasteful. Dispatching the job to a queue means the response returns immediately, while php artisan queue:work runs a background worker that processes it gradually. This is the standard reason to push all slow work (mail, image resizing, external API calls) onto a queue.

References

Laravel docs — Queues

Question 12Security

In Blade, how does `{{ $comment }}` differ from `{!! $comment !!}` when `$comment` is user input?

A.They are the same — {!! !!} is legacy syntax kept for compatibility
B.{{ }} escapes HTML and blocks XSS while {!! !!} prints raw
C.{!! !!} is faster because it skips Blade compilation
D.{{ }} can only print strings while {!! !!} prints any type

Answer: B

{{ }} automatically runs htmlspecialchars — a user typing <script> just shows up as text, blocking XSS by default. {!! !!} prints raw output and should only be used for HTML you control or have sanitized. Rule: user-supplied data never goes through {!! !!} directly.

References

Laravel docs — Blade: Displaying data

Intermediate level — 26 PHP questions

Question 1Arrays

You assign `$b = $a` where `$a` is an array, then modify `$b`. What happens to `$a`?

A.$a changes too because both variables point at one array
B.$a changes too if the array has more than one element
C.PHP warns because assigning an array requires clone
D.$a is unchanged — arrays are copied on assignment

Answer: D

$a stays unchanged. Arrays in PHP are value types: assignment (and passing to a function) makes a copy. Objects, by contrast, are assigned by handle — $b = $obj leaves both variables pointing at one instance, so changes via $b are visible through $obj immediately. This array/object difference is the most common interview question.

References

PHP docs — Arrays

Question 2Types

What does `declare(strict_types=1)` at the top of a file change?

A.It requires every variable in the file to be typed before use
B.Calling a function with the wrong scalar type throws a TypeError instead of coercing
C.It applies strict mode to the whole project from the first file that declares it
D.It disables type juggling entirely so == behaves like ===

Answer: B

It enables strict mode for type declarations: calling a function declared with int and passing '5' (a string) throws a TypeError instead of coercing as in the default weak mode. The scope is per file — it only applies to calls written in the file that has the declare, and does not leak into other files.

References

PHP docs — Strict typing

Question 3OOP

When should you choose a trait over an abstract class in PHP?

A.When you need a shared constructor for a whole inheritance tree
B.When you need to reuse code across classes in different inheritance trees
C.When you need to force subclasses to implement a list of required methods
D.When you need shared constants across several classes

Answer: B

Choose a trait when you need to reuse code horizontally across classes that don't share an inheritance tree — PHP is single-inheritance but you can use multiple traits. Interface = a pure contract (signatures only). Abstract class = a common skeleton for a family of classes that truly share a nature, with state plus partial implementation.

References

PHP docs — Traits

Question 4Core

`use` captures by value — what does the following code print?

php

$count = 0;

$inc = function () use ($count) {
    return $count + 1;
};

$count = 10;
echo $inc();

A.An "undefined variable" warning because the closure cannot see $count
B.11 — a closure always reads the outer variable's newest value
C.1 — the closure captured the value at definition time
D.An error because $count is reassigned after the closure captured it

Answer: C

It prints 1. use ($count) captures by value at the point the closure is defined — inside it holds the copy 0, so the later $count = 10 has no effect. To let the closure see the latest value (and modify the original variable), use use (&$count) — capture by reference.

References

PHP docs — Anonymous functions

Question 5Core

You must read a multi-GB CSV and process each line. Why use a generator (`yield`) instead of returning an array of all lines?

A.A generator compresses data in memory so it can hold a large file
B.A generator reads the file across several parallel threads so it is faster
C.PHP arrays have a hard element limit so a generator is mandatory
D.It holds only one element at a time so memory does not depend on the file size

Answer: D

A generator produces one value at a time as it is iterated, instead of building an array holding every line: memory stays flat no matter how many GB the file is, whereas returning an array would blow past memory_limit. A function containing yield pauses after each value and resumes when the loop asks for the next one.

References

PHP docs — Generators overview

Question 6Core

composer.json declares `"autoload": {"psr-4": {"App\\": "src/"}}`. Which file must contain the class `App\Repository\UserRepository`?

A.Any file, as long as you require it manually at the top of the consuming file
B.src/Repository/UserRepository.php
C.src/App/Repository/UserRepository.php — keeping the whole namespace as the path
D.src/repository/user-repository.php — PSR-4 requires lowercase paths

Answer: B

src/Repository/UserRepository.php. PSR-4 rule: strip the declared namespace prefix (App\ → src/), the remaining namespace maps to a directory tree, and the class name becomes the .php file name — case-sensitive exact match. Composer generates the autoloader from this mapping via vendor/autoload.php.

References

PHP-FIG — PSR-4: Autoloader

Question 7Web

In an app running on PHP-FPM, a developer uses a static variable to cache data across requests. What happens?

A.It does not work — each request starts with fresh state
B.The cache works if OPcache is enabled
C.The cache works because an FPM worker is a long-lived process
D.The cache is only lost when the request lands on a different worker

Answer: A

It doesn't work. PHP follows a share-nothing model: each request executes the script from scratch and every variable (including statics) is destroyed when the request ends. To cache across requests you must use storage outside the process: Redis, Memcached, APCu, files.

References

PHP docs — FastCGI Process Manager (FPM)

Question 8Security

What is the most serious problem in this code?

php

$id = $_GET['id'];
$stmt = $pdo->query("SELECT * FROM users WHERE id = " . $id);

A.Missing HTML escaping, so it is vulnerable to XSS when the result is displayed
B.Only dangerous when the id is a string; a numeric id is safe
C.A syntax error because query() does not accept a concatenated string
D.SQL injection — the input is concatenated straight into the SQL

Answer: A

SQL injection. $_GET['id'] is concatenated straight into the SQL, so an attacker sending ?id=1 OR 1=1 can read the whole table. Fix with a prepared statement: $pdo->prepare('SELECT * FROM users WHERE id = ?') then execute([$id]) — statement structure and data are kept separate.

References

PHP docs — PDO prepared statements

Question 9Laravel Core

A Laravel controller declares `__construct(OrderService $service)`. Where does the OrderService instance come from?

A.Composer's autoloader creates every service when the app boots
B.PHP instantiates the object itself when it sees a constructor type hint
C.The developer must instantiate and pass it in when declaring the route
D.The service container resolves it from the type hint and injects it automatically

Answer: D

Laravel's service container. When it needs to build the controller, the container uses reflection to read the constructor's type-hints, resolves OrderService itself (and all of its own dependencies, recursively), then injects it. You never new it anywhere — this is automatic dependency injection (auto-wiring).

References

Laravel docs — Service Container

Question 10Laravel Core

Calling `Cache::get('key')` in Laravel — what actually is Cache?

A.A global helper function aliased to look like a class
B.A class of static methods operating on the cache directly
C.A facade — a static proxy to the cache service in the container
D.A trait mixed into every class of the application

Answer: C

A Facade is a static proxy to a service in the container. Cache::get() is not a real static method: the magic method __callStatic catches the call, resolves the cache service from the container (via the key in getFacadeAccessor()), then calls get() on that instance. The syntax looks static, but underneath it's an ordinary object.

References

Laravel docs — Facades

Question 11Laravel Core· select all that apply

Which statements about Laravel middleware are correct?

A.Global middleware runs for every request while route middleware runs only for that route
B.Middleware can only run after the controller has finished
C.Each request may pass through at most one middleware
D.Middleware can stop a request and return a response without reaching the controller
E.The order of middleware in the pipeline affects the outcome

Answer: A, D, E

Middleware is a pipeline: the request passes through a chain of nested layers before reaching the controller, and the response travels back out. Each middleware decides whether to call $next($request) to continue, or return a response immediately to block. Global middleware runs for every request; route middleware runs only for that route. Order matters.

References

Laravel docs — Middleware

Question 12Eloquent

The posts table has 100 rows. How many queries does this code run?

php

$posts = Post::all();
foreach ($posts as $post) {
    echo $post->author->name;
}

A.101 — one query for the posts plus one per post for the author
B.200 — each post needs one query for the post and one for the author
C.1 — Eloquent joins the authors table automatically
D.2 — Eloquent eager loads the relation on first access

Answer: A

101 queries — the classic N+1 problem. Post::all() runs 1 query; each access of $post->author hits an unloaded relation, so Eloquent lazy-loads it with its own query × 100. Fix: Post::with('author')->get() — eager loading collapses it to 2 queries (SELECT * FROM posts + SELECT * FROM authors WHERE id IN (...)).

References

Laravel docs — Eager Loading

Question 13Laravel Core

A controller receives a FormRequest and validation fails. What happens?

A.It returns a redirect with the errors (or JSON 422) and the controller never runs
B.It only fails when the controller calls $request->validate() manually
C.It throws a ValidationException and returns a 500 to the user
D.The controller still runs and the developer must check whether validated() is empty

Answer: A

Validation runs before the controller is called — at the moment the container resolves the FormRequest. On failure Laravel returns automatically: a normal request → redirect back with errors in the session (displayed via $errors) plus old input; a JSON/AJAX request → 422 with the list of errors. Reaching the controller means the data already passed rules().

References

Laravel docs — Form Request Validation

Question 14Security

What attack does the @csrf directive in a Blade form protect against, and how?

A.SQL injection — the token encrypts the form data before sending
B.Brute force — the token limits how often a form may be submitted
C.CSRF — the server compares the form's token with the session's
D.XSS — the token stops foreign scripts running in the page

Answer: C

It protects against CSRF — a malicious site tricking a logged-in user's browser into sending a real request to your app (the cookie goes along automatically). @csrf prints a secret token tied to the session into the form; the ValidateCsrfToken middleware compares the submitted token with the one in the session — the foreign site can't read the token, so the forged request is blocked with a 419 error.

References

Laravel docs — CSRF Protection

Question 15Queues

A job in the Laravel queue throws an exception while running. What happens next?

A.It is retried per $tries/backoff and lands in failed_jobs once the attempts run out
B.It goes to the back of the queue and retries forever until it succeeds
C.The worker stops until that job succeeds
D.The job is dropped from the queue immediately and only written to the error log

Answer: A

The job is retried until it hits the $tries limit (or retry_until), with each attempt spaced by $backoff. Once attempts run out, the job goes into the failed_jobs table along with the exception — inspect it with php artisan queue:failed, rerun it with queue:retry. Nothing is silently lost.

References

Laravel docs — Dealing with failed jobs

Question 16Performance

How does `Cache::remember('top_products', 600, fn () => Product::top()->get())` work?

A.It stores the closure itself in the cache and re-executes it on every read
B.It runs the closure every time and compares with the cache to decide whether to overwrite
C.On a hit it returns from the cache; on a miss it runs the closure and stores it for 600 seconds
D.It only stores non-null results, and 600 is in minutes

Answer: C

The read-through cache pattern: if the top_products key is in the cache, return it directly; otherwise run the closure, store the result with a 600-second TTL, and return it. The heavy query runs once every 10 minutes instead of on every request — one line replacing a hand-written get/miss/put block.

References

Laravel docs — Cache: retrieve & store

Question 17Performance

How does OPcache speed up a PHP application?

A.It stores the compiled bytecode in shared memory
B.It caches the page's HTML output to serve the next request directly
C.It caches database query results at the PHP layer
D.It compresses the PHP files on disk so they read faster

Answer: A

On every request, plain PHP has to read the .php file, parse it, and compile it to bytecode before running. OPcache stores that bytecode in shared memory — from the second request on, the parse/compile step is skipped entirely. With a framework that loads thousands of files like Laravel, this is a big and nearly free speedup; always enabled in production.

References

PHP docs — OPcache introduction

Question 18Performance· select all that apply

Which commands belong in a Laravel production deploy script for performance? (multiple answers)

A.composer install --no-dev --optimize-autoloader
B.composer update
C.php artisan config:cache
D.Set APP_DEBUG=true to make errors easier to follow
E.php artisan route:cache

Answer: A, C, E

The standard set: composer install --no-dev --optimize-autoloader + php artisan config:cache + route:cache (plus view:cache, or the combined optimize call). Never composer update on production (it breaks the lockfile's reproducibility) and never enable APP_DEBUG (it leaks sensitive information).

References

Laravel docs — Deployment: optimization

Question 19Laravel Core

What is missing from this payment-processing code?

php

$wallet->decrement('balance', $order->total);
$order->update(['status' => 'paid']);

A.Wrap the two statements in DB::transaction()
B.Call $wallet->save() after the decrement
C.Switch to raw SQL so the two statements run atomically together
D.Adding try/catch around the two statements is enough

Answer: A

It's missing a transaction. If the order update fails (connection lost, constraint) after the wallet was already debited, the money is gone but the order is still not paid. Wrapping it in DB::transaction(function () { ... }) makes an exception inside roll back both — either both complete or it's as if nothing happened. Rule: multiple writes that must stay consistent with each other → transaction.

References

Laravel docs — Database transactions

Question 20Eloquent

A model uses the `SoftDeletes` trait. What happens when you call `$post->delete()`?

A.The record is removed from the table but archived into another table
B.The record is deleted for good; keeping it requires a separate softDelete() method
C.The deleted_at column is set and Eloquent queries exclude the record by default
D.The deleted_at column is set but queries still return it unless you add a filter

Answer: C

delete() only sets a timestamp in the deleted_at column — the record stays in the table. The trait registers a global scope that automatically adds where deleted_at is null to every Eloquent query, so the record "disappears" from normal code. Retrieve it with withTrashed()/onlyTrashed(), restore it with restore(), permanently delete it with forceDelete().

References

Laravel docs — Eloquent: soft deleting

Question 21Laravel Core

What problem does an API Resource (`php artisan make:resource`) solve compared to returning the model directly from a controller?

A.It paginates every list response automatically
B.It controls which fields are returned, decoupling the JSON shape from the table's
C.It caches the JSON response automatically so the API responds faster
D.It validates the input before the request reaches the controller

Answer: B

Returning the model directly exposes the database schema to the API: every column shows up in the JSON, including sensitive columns or ones added later, and renaming a column breaks the contract with clients. A Resource puts a transform layer in between — explicitly declaring which fields are returned, what they're named, and how they're formatted — so the schema and the API can change independently.

References

Laravel docs — Eloquent: API resources

Question 22PHP 8

What do PHP 8.1 enums offer over class constants?

A.They use less memory than ordinary constants
B.They are saved to the database automatically
C.The type is constrained and rejects values outside the set
D.They allow the value to be changed at runtime

Answer: C

An enum is a real type: a parameter typed as an enum only accepts the defined cases, so invalid values are blocked at the call site. Class constants are just primitive values, so any string or number can still be passed by mistake.

References

PHP Manual — Enumerations

Question 23PHP 8

What does declaring `public readonly string $id;` change?

A.The property becomes private to the outside
B.It can be assigned only once, within its declaring scope
C.The property is automatically initialized to an empty value
D.The property is read-only and cannot be passed to a function

Answer: B

The property can only be assigned once, from the declaring scope — usually the constructor. Any later assignment throws an error, even from inside the class. This is a way to create immutable objects without hand-writing getters.

References

PHP Manual — Readonly properties

Question 24PHP 8

What benefit do named arguments provide?

A.It checks each parameter's type automatically
B.Skipping parameters that have defaults, and making the intent clear
C.It allows passing any number of parameters
D.It makes the function faster when it has many parameters

Answer: B

Two benefits: skip parameters that have default values to reach the one you need, and read clearly at the call site — a bare true parameter doesn't say what it enables.

References

PHP Manual — Named arguments

Question 25PHP 8

How does `?->` behave in `$order?->customer?->name`?

A.It throws a catchable exception instead of a fatal error
B.It returns null immediately and skips the rest
C.It creates an empty object so the chain can continue
D.It returns an empty string when it meets a null value

Answer: B

If null is encountered at any link, the whole expression stops immediately and returns null — later calls don't run. This eliminates errors from calling methods on null and removes the need for nested conditionals.

References

PHP Manual — Nullsafe operator

Question 26Security

How do PDO prepared statements prevent SQL injection?

A.The statement and the data are sent separately
B.The query results are checked before being returned
C.The statement is checked against a list of forbidden keywords
D.Dangerous characters in the data are replaced

Answer: A

The statement and data are sent separately: the database parses the structure first, then receives the parameter values. Because the structure is fixed, parameter content cannot become SQL syntax no matter what characters it contains.

References

PHP Manual — Prepared statements

Beginner level — 12 PHP questions

Question 1Types

In PHP, how does `==` differ from `===`?

A.== only works for numbers while === works for every type
B.== compares values while === compares the variables' memory addresses
C.=== compares both type and value with no coercion
D.=== is slower than == because it also compares the type

Answer: C

References

PHP docs — Comparison operators

Question 2Core

What does `$b = &$a` do?

A.It creates a read-only copy of $a, so writing to $b errors
B.Both variables point at one value — changing either shows in the other
C.It copies $a's value into $b but faster than a normal assignment
D.It takes $a's memory address into $b like a C pointer

Answer: B

References

PHP docs — References explained

Question 3Core

Given `$name = $_GET['name'] ?? 'guest';` — how does the `??` operator behave?

A.It returns the right side when the left is null or does not exist, with no error
B.It returns the right side for any falsy left side, including 0 and an empty string
C.It is equivalent to empty() — returning the right side when the value is empty or zero
D.It warns about an undefined index if the name key is missing before returning the right side

Answer: A

References

PHP docs — Null coalescing operator

Question 4Errors

Since PHP 7, how are `Error` and `Exception` related?

A.Error extends Exception so catch (Exception $e) catches both
B.Exception was fully replaced by Error in PHP 7
C.Both implement the Throwable interface and can be caught together with Throwable
D.Error cannot be caught, so the program always stops

Answer: C

References

PHP docs — Errors in PHP 7

Question 5OOP

When does PHP invoke a class's `__get()` magic method?

A.Every time any property is read, including existing public ones
B.When calling a method that does not exist on the object
C.When reading a property that does not exist or is not accessible from outside
D.When the object is passed to var_dump or print_r

Answer: C

References

PHP docs — Magic methods

Question 6Core· select all that apply

Which statements about `match` (PHP 8) compared to `switch` are true?

A.It allows falling through to the branch below when a branch is left empty
B.It is an expression — you can assign directly with $x = match(...) {...}
C.You must write break at the end of each branch to stop it running on
D.It compares strictly (===) with no coercion like switch
E.It throws UnhandledMatchError when nothing matches and there is no default

Answer: B, D, E

References

PHP docs — match

Question 7Web

How does a PHP session maintain login state across requests?

A.The server stores the data by session ID and the browser returns the ID in a cookie
B.The server identifies the user by their IP address
C.The browser stores the data in localStorage and sends it with each request
D.All the session data is stored in a cookie and sent with each request

Answer: A

References

PHP docs — Session introduction

Question 8Security

Why store passwords with password_hash() instead of md5()?

A.md5() cannot handle long passwords or special characters
B.password_hash() is reversible so the original can be recovered when needed
C.md5() was removed from recent PHP versions
D.A deliberately slow algorithm with a salt — resisting brute force and rainbow tables

Answer: D

References

PHP docs — password_hash

Question 9Laravel Core

Route `/users/{user}` points to a controller receiving `User $user`. How does Laravel handle it?

A.It creates a new User instance with the id from the URL without querying
B.It finds the User by the id in the URL and returns 404 when it does not exist
C.It passes the raw id string and the developer calls find() in the controller
D.It queries the User by id and throws a 500 when not found

Answer: B

References

Laravel docs — Route Model Binding

Question 10Laravel Core

Why use migrations instead of altering the database schema directly?

A.The production database does not allow running ALTER TABLE directly
B.Migrations make queries run faster through automatic index optimization
C.The schema becomes versioned code — every environment applies the same change
D.Migrations back the data up automatically before each schema change

Answer: C

References

Laravel docs — Migrations

Question 11Queues

After a user signs up, the system sends a welcome email. Why dispatch the email to a queue instead of sending it inside the request?

A.The queue encrypts the email content so it is safer
B.Email sent through a queue has a higher inbox rate
C.Laravel requires every Mailable to go through a queue
D.The request returns immediately while the slow work runs in a background worker

Answer: D

References

Laravel docs — Queues

Question 12Security

In Blade, how does `{{ $comment }}` differ from `{!! $comment !!}` when `$comment` is user input?

A.They are the same — {!! !!} is legacy syntax kept for compatibility
B.{{ }} escapes HTML and blocks XSS while {!! !!} prints raw
C.{!! !!} is faster because it skips Blade compilation
D.{{ }} can only print strings while {!! !!} prints any type

Answer: B

References

Laravel docs — Blade: Displaying data

Intermediate level — 26 PHP questions

Question 1Arrays

You assign `$b = $a` where `$a` is an array, then modify `$b`. What happens to `$a`?

A.$a changes too because both variables point at one array
B.$a changes too if the array has more than one element
C.PHP warns because assigning an array requires clone
D.$a is unchanged — arrays are copied on assignment

Answer: D

References

PHP docs — Arrays

Question 2Types

What does `declare(strict_types=1)` at the top of a file change?

A.It requires every variable in the file to be typed before use
B.Calling a function with the wrong scalar type throws a TypeError instead of coercing
C.It applies strict mode to the whole project from the first file that declares it
D.It disables type juggling entirely so == behaves like ===

Answer: B

References

PHP docs — Strict typing

Question 3OOP

When should you choose a trait over an abstract class in PHP?

A.When you need a shared constructor for a whole inheritance tree
B.When you need to reuse code across classes in different inheritance trees
C.When you need to force subclasses to implement a list of required methods
D.When you need shared constants across several classes

Answer: B

References

PHP docs — Traits

Question 4Core

`use` captures by value — what does the following code print?

php

$count = 0;

$inc = function () use ($count) {
    return $count + 1;
};

$count = 10;
echo $inc();

A.An "undefined variable" warning because the closure cannot see $count
B.11 — a closure always reads the outer variable's newest value
C.1 — the closure captured the value at definition time
D.An error because $count is reassigned after the closure captured it

Answer: C

References

PHP docs — Anonymous functions

Question 5Core

You must read a multi-GB CSV and process each line. Why use a generator (`yield`) instead of returning an array of all lines?

A.A generator compresses data in memory so it can hold a large file
B.A generator reads the file across several parallel threads so it is faster
C.PHP arrays have a hard element limit so a generator is mandatory
D.It holds only one element at a time so memory does not depend on the file size

Answer: D

References

PHP docs — Generators overview

Question 6Core

composer.json declares `"autoload": {"psr-4": {"App\\": "src/"}}`. Which file must contain the class `App\Repository\UserRepository`?

A.Any file, as long as you require it manually at the top of the consuming file
B.src/Repository/UserRepository.php
C.src/App/Repository/UserRepository.php — keeping the whole namespace as the path
D.src/repository/user-repository.php — PSR-4 requires lowercase paths

Answer: B

References

PHP-FIG — PSR-4: Autoloader

Question 7Web

In an app running on PHP-FPM, a developer uses a static variable to cache data across requests. What happens?

A.It does not work — each request starts with fresh state
B.The cache works if OPcache is enabled
C.The cache works because an FPM worker is a long-lived process
D.The cache is only lost when the request lands on a different worker

Answer: A

References

PHP docs — FastCGI Process Manager (FPM)

Question 8Security

What is the most serious problem in this code?

php

$id = $_GET['id'];
$stmt = $pdo->query("SELECT * FROM users WHERE id = " . $id);

A.Missing HTML escaping, so it is vulnerable to XSS when the result is displayed
B.Only dangerous when the id is a string; a numeric id is safe
C.A syntax error because query() does not accept a concatenated string
D.SQL injection — the input is concatenated straight into the SQL

Answer: A

References

PHP docs — PDO prepared statements

Question 9Laravel Core

A Laravel controller declares `__construct(OrderService $service)`. Where does the OrderService instance come from?

A.Composer's autoloader creates every service when the app boots
B.PHP instantiates the object itself when it sees a constructor type hint
C.The developer must instantiate and pass it in when declaring the route
D.The service container resolves it from the type hint and injects it automatically

Answer: D

References

Laravel docs — Service Container

Question 10Laravel Core

Calling `Cache::get('key')` in Laravel — what actually is Cache?

A.A global helper function aliased to look like a class
B.A class of static methods operating on the cache directly
C.A facade — a static proxy to the cache service in the container
D.A trait mixed into every class of the application

Answer: C

References

Laravel docs — Facades

Question 11Laravel Core· select all that apply

Which statements about Laravel middleware are correct?

A.Global middleware runs for every request while route middleware runs only for that route
B.Middleware can only run after the controller has finished
C.Each request may pass through at most one middleware
D.Middleware can stop a request and return a response without reaching the controller
E.The order of middleware in the pipeline affects the outcome

Answer: A, D, E

References

Laravel docs — Middleware

Question 12Eloquent

The posts table has 100 rows. How many queries does this code run?

php

$posts = Post::all();
foreach ($posts as $post) {
    echo $post->author->name;
}

A.101 — one query for the posts plus one per post for the author
B.200 — each post needs one query for the post and one for the author
C.1 — Eloquent joins the authors table automatically
D.2 — Eloquent eager loads the relation on first access

Answer: A

References

Laravel docs — Eager Loading

Question 13Laravel Core

A controller receives a FormRequest and validation fails. What happens?

A.It returns a redirect with the errors (or JSON 422) and the controller never runs
B.It only fails when the controller calls $request->validate() manually
C.It throws a ValidationException and returns a 500 to the user
D.The controller still runs and the developer must check whether validated() is empty

Answer: A

References

Laravel docs — Form Request Validation

Question 14Security

What attack does the @csrf directive in a Blade form protect against, and how?

A.SQL injection — the token encrypts the form data before sending
B.Brute force — the token limits how often a form may be submitted
C.CSRF — the server compares the form's token with the session's
D.XSS — the token stops foreign scripts running in the page

Answer: C

References

Laravel docs — CSRF Protection

Question 15Queues

A job in the Laravel queue throws an exception while running. What happens next?

A.It is retried per $tries/backoff and lands in failed_jobs once the attempts run out
B.It goes to the back of the queue and retries forever until it succeeds
C.The worker stops until that job succeeds
D.The job is dropped from the queue immediately and only written to the error log

Answer: A

References

Laravel docs — Dealing with failed jobs

Question 16Performance

How does `Cache::remember('top_products', 600, fn () => Product::top()->get())` work?

A.It stores the closure itself in the cache and re-executes it on every read
B.It runs the closure every time and compares with the cache to decide whether to overwrite
C.On a hit it returns from the cache; on a miss it runs the closure and stores it for 600 seconds
D.It only stores non-null results, and 600 is in minutes

Answer: C

References

Laravel docs — Cache: retrieve & store

Question 17Performance

How does OPcache speed up a PHP application?

A.It stores the compiled bytecode in shared memory
B.It caches the page's HTML output to serve the next request directly
C.It caches database query results at the PHP layer
D.It compresses the PHP files on disk so they read faster

Answer: A

References

PHP docs — OPcache introduction

Question 18Performance· select all that apply

Which commands belong in a Laravel production deploy script for performance? (multiple answers)

A.composer install --no-dev --optimize-autoloader
B.composer update
C.php artisan config:cache
D.Set APP_DEBUG=true to make errors easier to follow
E.php artisan route:cache

Answer: A, C, E

References

Laravel docs — Deployment: optimization

Question 19Laravel Core

What is missing from this payment-processing code?

php

$wallet->decrement('balance', $order->total);
$order->update(['status' => 'paid']);

A.Wrap the two statements in DB::transaction()
B.Call $wallet->save() after the decrement
C.Switch to raw SQL so the two statements run atomically together
D.Adding try/catch around the two statements is enough

Answer: A

References

Laravel docs — Database transactions

Question 20Eloquent

A model uses the `SoftDeletes` trait. What happens when you call `$post->delete()`?

A.The record is removed from the table but archived into another table
B.The record is deleted for good; keeping it requires a separate softDelete() method
C.The deleted_at column is set and Eloquent queries exclude the record by default
D.The deleted_at column is set but queries still return it unless you add a filter

Answer: C

References

Laravel docs — Eloquent: soft deleting

Question 21Laravel Core

What problem does an API Resource (`php artisan make:resource`) solve compared to returning the model directly from a controller?

A.It paginates every list response automatically
B.It controls which fields are returned, decoupling the JSON shape from the table's
C.It caches the JSON response automatically so the API responds faster
D.It validates the input before the request reaches the controller

Answer: B

References

Laravel docs — Eloquent: API resources

Question 22PHP 8

What do PHP 8.1 enums offer over class constants?

A.They use less memory than ordinary constants
B.They are saved to the database automatically
C.The type is constrained and rejects values outside the set
D.They allow the value to be changed at runtime

Answer: C

References

PHP Manual — Enumerations

Question 23PHP 8

What does declaring `public readonly string $id;` change?

A.The property becomes private to the outside
B.It can be assigned only once, within its declaring scope
C.The property is automatically initialized to an empty value
D.The property is read-only and cannot be passed to a function

Answer: B

References

PHP Manual — Readonly properties

Question 24PHP 8

What benefit do named arguments provide?

A.It checks each parameter's type automatically
B.Skipping parameters that have defaults, and making the intent clear
C.It allows passing any number of parameters
D.It makes the function faster when it has many parameters

Answer: B

Two benefits: skip parameters that have default values to reach the one you need, and read clearly at the call site — a bare true parameter doesn't say what it enables.

References

PHP Manual — Named arguments

Question 25PHP 8

How does `?->` behave in `$order?->customer?->name`?

A.It throws a catchable exception instead of a fatal error
B.It returns null immediately and skips the rest
C.It creates an empty object so the chain can continue
D.It returns an empty string when it meets a null value

Answer: B

References

PHP Manual — Nullsafe operator

Question 26Security

How do PDO prepared statements prevent SQL injection?

A.The statement and the data are sent separately
B.The query results are checked before being returned
C.The statement is checked against a list of forbidden keywords
D.Dangerous characters in the data are replaced

Answer: A

References

PHP Manual — Prepared statements

Beginner level — 12 PHP questions

In PHP, how does == differ from ===?

What does $b = &$a do?

Given $name = $_GET['name'] ?? 'guest'; — how does the ?? operator behave?

Since PHP 7, how are Error and Exception related?

When does PHP invoke a class's __get() magic method?

Which statements about match (PHP 8) compared to switch are true?

How does a PHP session maintain login state across requests?

Why store passwords with password_hash() instead of md5()?

Route /users/{user} points to a controller receiving User $user. How does Laravel handle it?

Why use migrations instead of altering the database schema directly?

After a user signs up, the system sends a welcome email. Why dispatch the email to a queue instead of sending it inside the request?

In Blade, how does {{ $comment }} differ from {!! $comment !!} when $comment is user input?

Intermediate level — 26 PHP questions

You assign $b = $a where $a is an array, then modify $b. What happens to $a?

What does declare(strict_types=1) at the top of a file change?

When should you choose a trait over an abstract class in PHP?

use captures by value — what does the following code print?

You must read a multi-GB CSV and process each line. Why use a generator (yield) instead of returning an array of all lines?

composer.json declares "autoload": {"psr-4": {"App\\": "src/"}}. Which file must contain the class App\Repository\UserRepository?

In an app running on PHP-FPM, a developer uses a static variable to cache data across requests. What happens?

What is the most serious problem in this code?

A Laravel controller declares __construct(OrderService $service). Where does the OrderService instance come from?

Calling Cache::get('key') in Laravel — what actually is Cache?

Which statements about Laravel middleware are correct?

The posts table has 100 rows. How many queries does this code run?

A controller receives a FormRequest and validation fails. What happens?

What attack does the @csrf directive in a Blade form protect against, and how?

A job in the Laravel queue throws an exception while running. What happens next?

How does Cache::remember('top_products', 600, fn () => Product::top()->get()) work?

How does OPcache speed up a PHP application?

Which commands belong in a Laravel production deploy script for performance? (multiple answers)

What is missing from this payment-processing code?

A model uses the SoftDeletes trait. What happens when you call $post->delete()?

What problem does an API Resource (php artisan make:resource) solve compared to returning the model directly from a controller?

What do PHP 8.1 enums offer over class constants?

What does declaring public readonly string $id; change?

What benefit do named arguments provide?

How does ?-> behave in $order?->customer?->name?

How do PDO prepared statements prevent SQL injection?

12 more Advanced questions for PHP

Beginner level — 12 PHP questions

In PHP, how does == differ from ===?

What does $b = &$a do?

Given $name = $_GET['name'] ?? 'guest'; — how does the ?? operator behave?

Since PHP 7, how are Error and Exception related?

When does PHP invoke a class's __get() magic method?

Which statements about match (PHP 8) compared to switch are true?

How does a PHP session maintain login state across requests?

Why store passwords with password_hash() instead of md5()?

Route /users/{user} points to a controller receiving User $user. How does Laravel handle it?

Why use migrations instead of altering the database schema directly?

After a user signs up, the system sends a welcome email. Why dispatch the email to a queue instead of sending it inside the request?

In Blade, how does {{ $comment }} differ from {!! $comment !!} when $comment is user input?

Intermediate level — 26 PHP questions

You assign $b = $a where $a is an array, then modify $b. What happens to $a?

What does declare(strict_types=1) at the top of a file change?

When should you choose a trait over an abstract class in PHP?

use captures by value — what does the following code print?

You must read a multi-GB CSV and process each line. Why use a generator (yield) instead of returning an array of all lines?

composer.json declares "autoload": {"psr-4": {"App\\": "src/"}}. Which file must contain the class App\Repository\UserRepository?

In an app running on PHP-FPM, a developer uses a static variable to cache data across requests. What happens?

What is the most serious problem in this code?

A Laravel controller declares __construct(OrderService $service). Where does the OrderService instance come from?

Calling Cache::get('key') in Laravel — what actually is Cache?

Which statements about Laravel middleware are correct?

The posts table has 100 rows. How many queries does this code run?

A controller receives a FormRequest and validation fails. What happens?

What attack does the @csrf directive in a Blade form protect against, and how?

A job in the Laravel queue throws an exception while running. What happens next?

How does Cache::remember('top_products', 600, fn () => Product::top()->get()) work?

How does OPcache speed up a PHP application?

Which commands belong in a Laravel production deploy script for performance? (multiple answers)

What is missing from this payment-processing code?

A model uses the SoftDeletes trait. What happens when you call $post->delete()?

What problem does an API Resource (php artisan make:resource) solve compared to returning the model directly from a controller?

What do PHP 8.1 enums offer over class constants?

What does declaring public readonly string $id; change?

What benefit do named arguments provide?

How does ?-> behave in $order?->customer?->name?

In PHP, how does `==` differ from `===`?

What does `$b = &$a` do?

Given `$name = $_GET['name'] ?? 'guest';` — how does the `??` operator behave?

Since PHP 7, how are `Error` and `Exception` related?

When does PHP invoke a class's `__get()` magic method?

Which statements about `match` (PHP 8) compared to `switch` are true?

Route `/users/{user}` points to a controller receiving `User $user`. How does Laravel handle it?

In Blade, how does `{{ $comment }}` differ from `{!! $comment !!}` when `$comment` is user input?

You assign `$b = $a` where `$a` is an array, then modify `$b`. What happens to `$a`?

What does `declare(strict_types=1)` at the top of a file change?

`use` captures by value — what does the following code print?

You must read a multi-GB CSV and process each line. Why use a generator (`yield`) instead of returning an array of all lines?

composer.json declares `"autoload": {"psr-4": {"App\\": "src/"}}`. Which file must contain the class `App\Repository\UserRepository`?

A Laravel controller declares `__construct(OrderService $service)`. Where does the OrderService instance come from?

Calling `Cache::get('key')` in Laravel — what actually is Cache?

How does `Cache::remember('top_products', 600, fn () => Product::top()->get())` work?

A model uses the `SoftDeletes` trait. What happens when you call `$post->delete()`?

What problem does an API Resource (`php artisan make:resource`) solve compared to returning the model directly from a controller?

What does declaring `public readonly string $id;` change?

How does `?->` behave in `$order?->customer?->name`?

In PHP, how does `==` differ from `===`?

What does `$b = &$a` do?

Given `$name = $_GET['name'] ?? 'guest';` — how does the `??` operator behave?

Since PHP 7, how are `Error` and `Exception` related?

When does PHP invoke a class's `__get()` magic method?

Which statements about `match` (PHP 8) compared to `switch` are true?

Route `/users/{user}` points to a controller receiving `User $user`. How does Laravel handle it?

In Blade, how does `{{ $comment }}` differ from `{!! $comment !!}` when `$comment` is user input?

You assign `$b = $a` where `$a` is an array, then modify `$b`. What happens to `$a`?

What does `declare(strict_types=1)` at the top of a file change?

`use` captures by value — what does the following code print?

You must read a multi-GB CSV and process each line. Why use a generator (`yield`) instead of returning an array of all lines?

composer.json declares `"autoload": {"psr-4": {"App\\": "src/"}}`. Which file must contain the class `App\Repository\UserRepository`?

A Laravel controller declares `__construct(OrderService $service)`. Where does the OrderService instance come from?

Calling `Cache::get('key')` in Laravel — what actually is Cache?

How does `Cache::remember('top_products', 600, fn () => Product::top()->get())` work?

A model uses the `SoftDeletes` trait. What happens when you call `$post->delete()`?

What problem does an API Resource (`php artisan make:resource`) solve compared to returning the model directly from a controller?

What does declaring `public readonly string $id;` change?

How does `?->` behave in `$order?->customer?->name`?