What Is PHP? Server-Side Programming for Beginners

Where PHP fits in a web request

1. A visitor opens a URL or submits a form, and the browser sends an HTTP request to your server.
2. The web server, such as Apache or Nginx, hands the request to PHP, usually through PHP-FPM.
3. Your PHP code reads the request, talks to a database such as MySQL if needed, and builds a response.
4. The server sends the finished HTML, or JSON for an API, back to the browser.

Because PHP runs on the server, it can safely hold database passwords and business rules that must never reach the browser. JavaScript, by contrast, runs on the visitor's device, where anyone can read it.

Modern PHP 8 syntax

PHP has changed a great deal since version 7. Current releases in the PHP 8 series add typed properties, union types, named arguments, enums, readonly properties and the match expression. Start every new file with strict types so PHP reports type mismatches instead of silently converting values.

<?php
declare(strict_types=1);

function shippingFee(float $total, string $zone): float
{
    return match ($zone) {
        'local'    => 0.0,
        'national' => $total >= 999 ? 0.0 : 60.0,
        default    => 150.0,
    };
}

echo shippingFee(total: 1200, zone: 'national');

Variables start with a dollar sign, statements end with a semicolon, and functions can declare the type of each parameter and of the return value. Use a supported PHP 8 release on every new project, because older versions no longer receive security fixes.

Handling a form with PDO prepared statements

The most common beginner task is saving form data to a database. PDO is PHP's built-in database layer, and prepared statements keep the SQL and the visitor's data separate, which prevents SQL injection.

<?php
declare(strict_types=1);

$pdo = new PDO('mysql:host=localhost;dbname=shop;charset=utf8mb4',
    'shop_app', getenv('DB_PASS'),
    [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);

$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
$name  = trim($_POST['name'] ?? '');

if ($email === false || $email === null || $name === '') {
    http_response_code(422);
    exit('Please enter a valid name and email.');
}

$stmt = $pdo->prepare('INSERT INTO subscribers (name, email) VALUES (?, ?)');
$stmt->execute([$name, $email]);

• The DSN sets charset=utf8mb4 so names in Hindi, Tamil or any other script are stored correctly.
• The database password comes from an environment variable rather than being written into the code.
• Exception mode makes PDO throw an error you can log instead of failing silently.
• The question marks are placeholders. The database receives the values separately and never treats them as SQL.

Validate, then protect the form itself

Validation answers the question "is this data acceptable?" Check that required fields are present, that emails and numbers have the right format, and that text is within a sensible length. When validation fails, send the form back with a clear message and the visitor's previous input, escaped, so they do not have to type everything again.

Forms that change data also need protection against cross-site request forgery (CSRF), where another site tricks a logged-in visitor's browser into submitting your form. The usual defence is a random token stored in the session, printed in a hidden field and compared on submission. Frameworks generate and check these tokens for you, and setting session cookies with the SameSite attribute adds a second layer.

Escaping output to prevent XSS

Data that was safe to store is not automatically safe to display. If a visitor saved a name containing a script tag, printing it directly would run that script for everyone who views the page. Escape every value when you output it into HTML.

<p>Welcome, <?= htmlspecialchars($name, ENT_QUOTES, 'UTF-8') ?></p>

htmlspecialchars converts characters such as <, > and quotes into harmless entities. Frameworks provide a shorter helper, such as esc() in CodeIgniter or double-brace syntax in Laravel Blade templates, that does the same job.

Storing passwords correctly

Never store passwords as plain text or with fast hashes such as MD5 or SHA-1. PHP includes functions that use a slow, salted algorithm designed for passwords.

$hash = password_hash($password, PASSWORD_DEFAULT);
// later, at login:
if (password_verify($attempt, $hash)) {
    session_regenerate_id(true);
    $_SESSION['user_id'] = $userId;
}

PASSWORD_DEFAULT currently uses bcrypt and may move to a stronger algorithm in future releases, so store hashes in a column of at least 255 characters. Regenerating the session ID after login protects against session fixation.

Tools, frameworks and next steps

• Composer installs and autoloads third-party packages and is standard in every modern PHP project.
• Frameworks such as Laravel, Symfony and CodeIgniter provide routing, validation, database tools and CSRF protection, so you write less repetitive code.
• Local development is simple: install PHP and run php -S localhost:8000 in your project folder, or use a package such as XAMPP or Laragon.

Learning plain PHP before a framework helps you understand what the framework is doing for you. When you are ready to connect PHP to a front end, read our guide to building and calling APIs. SkillNewton also teaches PHP through projects in its online course for aspiring web developers.

Common mistakes

• Concatenating $_POST or $_GET values straight into SQL, which allows SQL injection.
• Printing stored or submitted data without htmlspecialchars or a framework escaping helper.
• Displaying full error messages on a live site, which can reveal file paths and database details to attackers.
• Hashing passwords with md5() or sha1() instead of password_hash().
• Running an unsupported PHP version on a live server because upgrading was postponed.

Frequently asked questions