Run a mock round

Composer is PHP's dependency manager. It reads composer.json, resolves a version graph and writes composer.lock to pin exact versions for reproducible installs. composer install uses the lock file; composer update re-resolves it.

The autoload section generates a class map so you do not require files manually:

• PSR-4 maps a namespace prefix to a directory, e.g. "App\\": "src/". The class App\Foo\Bar loads from src/Foo/Bar.php.
• classmap scans directories; files always includes a file.
• composer dump-autoload -o builds an optimised classmap for production.

Include vendor/autoload.php at the entry point and namespaces resolve automatically.

Never concatenate user input into SQL. Use prepared statements with bound parameters, which separate code from data.

$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email AND active = 1');
$stmt->execute([':email' => $email]);
$user = $stmt->fetch();

Also:

• Use PDO or mysqli with emulation disabled (PDO::ATTR_EMULATE_PREPARES => false).
• Validate and whitelist anything that cannot be bound, such as column names or ORDER BY direction.
• Apply least privilege to the database user and escape output with htmlspecialchars for XSS.
• Store passwords with password_hash and verify with password_verify.

Output escaping encodes user-controlled data at the moment it is written into HTML so browsers treat it as text, not markup. This is the primary defence against XSS.

echo htmlspecialchars($comment, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');

Rules:

• Escape on output, not on input. Store raw, encode per context (HTML, attribute, URL, JavaScript).
• Use a templating engine that auto-escapes (Twig, Blade, Laravel) to avoid forgetting.
• Combine with a Content-Security-Policy header that disallows inline scripts.
• Do not rely on strip_tags alone; it is not sufficient.

For attributes use ENT_QUOTES; for URLs use rawurlencode; inside script blocks prefer JSON encoding.

• Named arguments: htmlspecialchars(string: $s, flags: ENT_QUOTES).
• Constructor property promotion and readonly properties.
• Match expression (strict comparison, returns a value).
• Nullsafe operator: $user?->address?->city.
• Union types, mixed and static return type.
• Attributes for metadata instead of docblock annotations.
• Enums with methods and backed values.
• Fibers for cooperative multitasking.
• Throw as an expression.
• JIT compiler for CPU-bound workloads.

enum Status: string {
  case Active = 'active';
  case Banned = 'banned';
  public function label(): string { return ucfirst($this->value); }
}

• include: includes a file; on failure emits a warning and execution continues.
• require: includes a file; on failure emits a fatal error and stops.
• include_once / require_once: same, but skip the file if it was already included, preventing redeclaration errors.

Use require for essential files (configuration, classes) and include for optional templates. In modern projects, Composer autoloading replaces most manual includes, and require_once is rarely needed outside bootstrap code.

Modern PHP uses exceptions. Throwable is the root interface with two branches: Error (engine-level, e.g. TypeError, DivisionByZeroError) and Exception (application-level).

try {
  risky();
} catch (ValidationException $e) {
  // handle
} catch (Throwable $e) {
  // fallback
  error_log($e->getMessage());
} finally {
  // always runs
}

Best practice: convert warnings to exceptions with set_error_handler, configure error_reporting(E_ALL), log errors rather than echo them, and never expose stack traces to users in production. Use a global handler via set_exception_handler and register_shutdown_function for fatal errors.

== compares values after type juggling, while === compares value and type without coercion.

0 == 'abc';   // false in PHP 8 (true in PHP 7 and earlier)
'1' == 1;     // true
'1' === 1;    // false
null == false;// true
0 == '';      // false in PHP 8

PHP 8 changed the comparison rules to be more intuitive, but the secure and predictable choice is almost always ===. Loose comparison has caused real security bugs, for example in authentication checks and the classic magic hash issue.