PHP interview questions

Types and comparison

• `==` versus `===` - and why loose comparison with mixed types is a reliable source of bugs. Modern PHP changed some string-to-number rules, which is worth knowing.
• `declare(strict_types=1)` - what it changes, and why it should be on.
• Nullable types, union types, and typed properties.
• `isset` versus `empty` versus `is_null`, and what each says about an undefined index.
• Pass by value versus by reference, and the fact that objects are handles rather than copies.

OOP and modern features

• Interfaces, abstract classes and traits - and what traits solve and what they cost.
• Static versus instance, and why heavy static use hurts testability.
• Magic methods, and a defensible opinion on `__get` and `__call`.
• Namespaces and autoloading through Composer and PSR-4.
• Enums, readonly properties, constructor promotion and match expressions, if the role uses a recent version.

Security, which comes up more than in most language interviews

• SQL injection and prepared statements with PDO - and why escaping is the weaker answer.
• XSS and output escaping in templates.
• CSRF tokens, and what the framework does for you.
• `password_hash` and `password_verify` - never a bare hash function.
• File upload handling, and what can go wrong.
• Why `eval` and unserialising untrusted input are dangerous.

Laravel and the ecosystem

Most PHP roles mention a framework. For Laravel, expect Eloquent and the N+1 problem with eager loading, the service container and dependency injection, middleware, queues and jobs, and migrations. For Symfony, services and the event dispatcher. The database half overlaps with SQL interview questions and MySQL-style query tuning.

How deep it goes by level

• Junior: the fundamentals above, explained clearly. Nobody expects production scars yet, and saying what you have not done reads better than bluffing.
• Mid-level: the same ground plus an application you have maintained and a framework you know well. Expect follow-ups asking why you made a choice rather than whether you know the syntax.
• Senior: a legacy upgrade you led, and performance work you measured. The recall questions get shorter and the judgement questions get longer.

Whatever the level, say your answers out loud rather than reading them. Most of what candidates lose in a PHP interview is lost between knowing something and explaining it under observation - the method is in how to use AI for interview prep.

Where CoPilot Interview fits

Disclosure: we build an interview assistant, so treat this as a disclosed pitch. CoPilot Interview is a native Windows and macOS app that puts suggested answers on your own screen in about two seconds, across coding, system design and behavioral rounds, with a permanent free tier that needs no credit card.

Frequently asked questions

What are the most common PHP interview questions?

`==` versus `===` and loose comparison pitfalls, strict types, interfaces versus abstract classes versus traits, SQL injection prevention with prepared statements, password hashing, and framework questions - usually Eloquent and the service container for Laravel.

What does declare(strict_types=1) do?

It makes PHP reject arguments and return values whose types do not match the declaration instead of silently coercing them, within that file. It catches a large class of bugs early and is expected in modern PHP codebases.

How do you prevent SQL injection in PHP?

Prepared statements with bound parameters through PDO or an ORM that uses them. Manual escaping is the weaker answer because it is easy to apply inconsistently, and interviewers listen specifically for which one you reach for first.

How should passwords be stored in PHP?

With `password_hash` and verified with `password_verify`, which use a deliberately slow adaptive algorithm and handle salting automatically. A bare hash such as MD5 or SHA-1, even salted by hand, is the answer that fails this question.