Run a mock round

• include: includes a file; on failure emits a warning and execution continues.
• require: includes a file; on failure emits a fatal error and stops.
• include_once / require_once: same, but skip the file if it was already included, preventing redeclaration errors.

Use require for essential files (configuration, classes) and include for optional templates. In modern projects, Composer autoloading replaces most manual includes, and require_once is rarely needed outside bootstrap code.

Never concatenate user input into SQL. Use prepared statements with bound parameters, which separate code from data.

$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email AND active = 1');
$stmt->execute([':email' => $email]);
$user = $stmt->fetch();

Also:

• Use PDO or mysqli with emulation disabled (PDO::ATTR_EMULATE_PREPARES => false).
• Validate and whitelist anything that cannot be bound, such as column names or ORDER BY direction.
• Apply least privilege to the database user and escape output with htmlspecialchars for XSS.
• Store passwords with password_hash and verify with password_verify.

== compares values after type juggling, while === compares value and type without coercion.

0 == 'abc';   // false in PHP 8 (true in PHP 7 and earlier)
'1' == 1;     // true
'1' === 1;    // false
null == false;// true
0 == '';      // false in PHP 8

PHP 8 changed the comparison rules to be more intuitive, but the secure and predictable choice is almost always ===. Loose comparison has caused real security bugs, for example in authentication checks and the classic magic hash issue.

Sessions persist state across stateless HTTP requests. session_start() creates or resumes a session identified by a cookie (PHPSESSID) and stores data server-side.

Security checklist:

• Regenerate the ID on privilege change: session_regenerate_id(true) after login to prevent session fixation.
• Set cookie flags: HttpOnly, Secure, and SameSite=Lax or Strict.
• Use session.use_strict_mode to reject unknown IDs.
• Store sessions outside the web root or in Redis for scale.
• Add CSRF tokens to state-changing forms.
• Set an idle timeout and destroy sessions on logout with session_destroy().

For APIs, prefer stateless tokens (JWT or opaque tokens) over PHP sessions.

• Named arguments: htmlspecialchars(string: $s, flags: ENT_QUOTES).
• Constructor property promotion and readonly properties.
• Match expression (strict comparison, returns a value).
• Nullsafe operator: $user?->address?->city.
• Union types, mixed and static return type.
• Attributes for metadata instead of docblock annotations.
• Enums with methods and backed values.
• Fibers for cooperative multitasking.
• Throw as an expression.
• JIT compiler for CPU-bound workloads.

enum Status: string {
  case Active = 'active';
  case Banned = 'banned';
  public function label(): string { return ucfirst($this->value); }
}

Modern PHP uses exceptions. Throwable is the root interface with two branches: Error (engine-level, e.g. TypeError, DivisionByZeroError) and Exception (application-level).

try {
  risky();
} catch (ValidationException $e) {
  // handle
} catch (Throwable $e) {
  // fallback
  error_log($e->getMessage());
} finally {
  // always runs
}

Best practice: convert warnings to exceptions with set_error_handler, configure error_reporting(E_ALL), log errors rather than echo them, and never expose stack traces to users in production. Use a global handler via set_exception_handler and register_shutdown_function for fatal errors.

Output escaping encodes user-controlled data at the moment it is written into HTML so browsers treat it as text, not markup. This is the primary defence against XSS.

echo htmlspecialchars($comment, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');

Rules:

• Escape on output, not on input. Store raw, encode per context (HTML, attribute, URL, JavaScript).
• Use a templating engine that auto-escapes (Twig, Blade, Laravel) to avoid forgetting.
• Combine with a Content-Security-Policy header that disallows inline scripts.
• Do not rely on strip_tags alone; it is not sufficient.

For attributes use ENT_QUOTES; for URLs use rawurlencode; inside script blocks prefer JSON encoding.