PHP interview questions and answers for 2026 (PHP 8.4 and 8.5)

PHP interviews in 2026 still open with the basics, but most interviewers now also check whether you know the language as it is today. PHP 8.5 was released on 20 November 2025, PHP 8.4 is in active support until the end of 2026, and PHP 8.2 reaches the end of its security support on 31 December 2026. If your answers describe PHP 7 behaviour, an interviewer will notice.

This set contains 22 questions grouped into beginner, intermediate and advanced levels. Each answer is short enough to say aloud in an interview, and each has been checked against the PHP manual and the official release announcements. Where code makes the answer clearer, there is a small example that runs on PHP 8.5.

Use it in two passes: first answer each question in your own words without looking, then compare with the model answer and note what you missed.

Which PHP version should you prepare for?

Know the supported branches and roughly what each added. The table below comes from the PHP project's supported-versions page as of 7 October 2026.

PHP 8.1 is end of life. If a job advert mentions Laravel 13, note that it requires PHP 8.3 or later.

Beginner questions

1. What is the difference between == and ===?

== compares values after type juggling; === compares value and type, with no conversion. Since PHP 8.0, comparing a number with a non-numeric string converts the number to a string and compares strings, so 0 == "a" is false (it was true in PHP 7). In practice, use === unless you deliberately want loose comparison.

2. What is the difference between include and require?

Both load and run another file. If the file cannot be loaded, include emits a warning and the script continues, while require stops with a fatal error. The _once variants skip the file if it has already been loaded. In modern projects you rarely call them directly because Composer's autoloader loads classes for you.

3. How do isset(), empty() and is_null() differ?

• isset($x) is true when the variable exists and is not null. It does not raise a warning for undefined variables.
• empty($x) is true when the variable does not exist or its value is falsy: "", "0", 0, 0.0, null, false or an empty array.
• is_null($x) is a normal function: it returns true only for null and warns if the variable is undefined.

4. What does declare(strict_types=1) do?

It switches scalar type declarations in that file from coercive mode to strict mode, so passing "5" to an int parameter throws a TypeError instead of being converted. It applies per file, and it applies to calls made from that file, not to functions declared in it. Return type checks in the file are strict too. The one allowed widening is passing an int where a float is expected.

<?php
declare(strict_types=1);

function total(int $a, int $b): int
{
    return $a + $b;
}

total(2, 3);     // 5
total("2", 3);   // TypeError in strict mode

5. What is the difference between a session and a cookie?

A cookie is stored in the browser and sent with every matching request, so the user can read and change it. A session stores data on the server; the browser only holds a session ID, usually in a cookie. Keep sensitive or authoritative data in the session, call session_regenerate_id(true) after login to prevent session fixation, and set cookies with Secure, HttpOnly and a suitable SameSite value.

6. How should passwords be stored?

Never store them in plain text or with a fast hash such as MD5 or SHA-256. Use password_hash($password, PASSWORD_DEFAULT) to store and password_verify() to check, and call password_needs_rehash() after a successful login so old hashes are upgraded. In PHP 8.4 the default bcrypt cost rose from 10 to 12.

Intermediate questions

7. Abstract class, interface or trait: when do you use each?

• Interface: a contract of public methods (and constants). A class can implement many. Use it for anything you want to swap, such as a payment gateway.
• Abstract class: a partial implementation that cannot be instantiated. A class can extend only one. Use it when subclasses share state or code.
• Trait: a reusable block of methods and properties copied into a class at compile time. It is code reuse, not a type: you cannot type-hint a trait.

8. What are enums and when are they better than class constants?

Enums (PHP 8.1) define a closed set of values as a real type. A pure enum has cases only; a backed enum maps each case to an int or string. Because Status is a type, a function that accepts Status cannot receive an invalid value, which constants cannot guarantee.

enum Status: string
{
    case Draft = 'draft';
    case Published = 'published';

    public function label(): string
    {
        return ucfirst($this->value);
    }
}

Status::from('draft');        // Status::Draft
Status::tryFrom('unknown');   // null instead of an error
Status::cases();              // list of all cases

9. How does match differ from switch?

match is an expression that returns a value, compares with ===, has no fall-through, and throws UnhandledMatchError if no arm matches and there is no default. switch is a statement, uses loose comparison and falls through without break.

10. What are readonly properties and readonly classes?

A readonly property (8.1) can be initialised once, from inside the class scope, and never changed afterwards. Marking a class readonly (8.2) makes every declared property readonly. They are useful for value objects and DTOs. To produce a changed copy, PHP 8.5 lets you write clone($this, ['alpha' => $alpha]), which updates properties during cloning.

11. What are named arguments and the nullsafe operator?

Named arguments (8.0) pass values by parameter name, so you can skip optional parameters and make calls self-documenting: htmlspecialchars($s, double_encode: false). The nullsafe operator ?-> short-circuits a chain to null if the left side is null: $user?->getAddress()?->city.

12. How do you prevent SQL injection in plain PHP?

Use prepared statements with bound parameters, never string concatenation. With PDO, also set the error mode to exceptions. Identifiers such as column names cannot be bound, so check them against an allowlist.

$pdo = new PDO($dsn, $user, $pass, [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_EMULATE_PREPARES => false,
]);

$stmt = $pdo->prepare('SELECT id, name FROM users WHERE email = :email');
$stmt->execute(['email' => $email]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

13. How does Composer autoloading work?

Composer reads the autoload section of composer.json and generates vendor/autoload.php. With PSR-4, a namespace prefix maps to a directory, so App\Http\Controller resolves to src/Http/Controller.php when "App\\": "src/" is configured. In production, run composer dump-autoload --optimize (or install with --optimize-autoloader) to build a class map.

14. What is the difference between Error and Exception?

Both implement Throwable. Exception is for conditions your application expects and may recover from. Error is thrown by the engine for programming problems such as TypeError, ValueError or calling an undefined method. catch (Exception $e) does not catch an Error; catch Throwable only at a top-level handler that logs and responds.

Advanced questions

15. What are property hooks and asymmetric visibility in PHP 8.4?

Property hooks attach get and set logic directly to a property, replacing many getter and setter methods. Asymmetric visibility sets different read and write scopes, for example public private(set): anyone can read the property, only the class can write it.

final class Account
{
    public private(set) int $balance = 0;

    public string $email {
        set (string $value) {
            $this->email = strtolower(trim($value));
        }
    }

    public function deposit(int $amount): void
    {
        $this->balance += $amount;
    }
}

16. What does the pipe operator in PHP 8.5 do?

|> passes the value on its left as the single argument to the callable on its right, so a chain of transformations reads left to right without temporary variables. The right side must be a callable taking one parameter, such as a first-class callable trim(...) or an arrow function in parentheses.

$slug = ' PHP 8.5 Released '
    |> trim(...)
    |> (fn (string $s) => str_replace([' ', '.'], ['-', ''], $s))
    |> strtolower(...);

// "php-85-released"

17. What other PHP 8.5 additions should you be able to name?

The built-in URI extension (RFC 3986 and WHATWG URL parsing), clone with property updates, the #[\NoDiscard] attribute that warns when a return value is ignored, closures and first-class callables in constant expressions, persistent cURL share handles, and the array_first() and array_last() functions. PHP 8.4 had already added array_find(), array_any() and array_all().

18. Explain self:: versus static::.

self:: refers to the class where the code is written. static:: uses late static binding and refers to the class that was actually called at runtime. A factory method public static function create(): static { return new static(); } in a parent class returns the child type when called as Child::create(); with new self() it would always return the parent.

19. When would you use a generator?

When you need to iterate over a large or unbounded sequence without loading it all into memory, such as reading a large CSV file line by line. A function that contains yield returns a Generator, which produces values on demand.

function readRows(string $path): Generator
{
    $handle = fopen($path, 'rb');
    try {
        while (($row = fgetcsv($handle, escape: '')) !== false) {
            yield $row;
        }
    } finally {
        fclose($handle);
    }
}

foreach (readRows('orders.csv') as $row) {
    // one row in memory at a time
}

20. What are Fibers?

Fibers (8.1) are interruptible functions with their own call stack. Code inside a fiber can call Fiber::suspend() and later be resumed. They do not run code in parallel; they are a low-level building block that libraries such as event loops use to write asynchronous code that looks synchronous. Most application developers use them indirectly.

21. How do OPcache and the JIT improve performance?

OPcache stores compiled opcodes in shared memory so PHP does not parse and compile scripts on every request; it should be enabled in every production deployment. The JIT (rebuilt on a new IR framework in PHP 8.4) compiles hot code to machine code. It helps CPU-heavy work such as maths or image processing more than typical database-bound web requests, so measure before relying on it.

22. How do you keep a PHP application secure in production?

Run a supported PHP branch and apply security releases, escape output with htmlspecialchars() or a template engine, use prepared statements, validate all input on the server, hash passwords with password_hash(), protect forms with CSRF tokens, set display_errors=Off and log errors instead, and audit dependencies with composer audit.

How to practise these answers

• Install PHP 8.5 locally and run every snippet above; change one thing and predict the result before you run it.
• For each question, prepare one sentence of definition and one real example from your own work.
• Read the "Backward incompatible changes" page of the migration guide for 8.4 and 8.5; interviewers like upgrade stories.
• Practise explaining code aloud: interviewers judge clarity as much as correctness.

Next steps

If you are interviewing for a framework role, continue with our Laravel interview questions, and pair this set with the MySQL questions, because most PHP roles involve SQL. Keep the official PHP manual open while you practise; it is the reference interviewers trust.