28. PHP Quiz

Where does PHP code run?

• In the visitor’s browser
• On the web server
• In the visitor’s operating system
• Inside the CSS file

PHP runs on the server and sends only its output, usually HTML, to the browser.

Which symbol starts every PHP variable name?

• #
• @
• $
• &

PHP variables start with a dollar sign, such as $name.

Which operator joins two strings in PHP?

• The dot (.)
• The plus sign (+)
• The ampersand (&)
• The comma (,)

PHP uses . to join text. The + operator is for numbers only.

Which comparison checks both value and type?

• =
• ==
• =>
• ===

=== is strict equality. A single = assigns, and => links an array key to a value.

Which loop is designed to go through every item of an array?

• while
• foreach
• do...while
• switch

foreach gives you each value, and optionally each key, of an array.

Which superglobal holds values sent by a form that uses method="post"?

• $_GET
• $_SERVER
• $_POST
• $_FILES

$_POST holds form values sent with POST. $_GET holds values from the address.

What should you do before printing text that a visitor typed?

• Escape it with htmlspecialchars()
• Convert it with strrev()
• Store it in a cookie
• Nothing, because PHP escapes automatically

Escaping stops visitor text from running as HTML or script (XSS). PHP does not do it for you.

What is the difference between include and require when the file is missing?

• There is no difference
• include stops the script and require continues
• Both only give a notice
• require stops with a fatal error, and include only warns

Use require for files the page cannot work without, and include for optional pieces.

Where is session data stored?

• In the visitor’s browser
• On the server, with only an ID kept in the browser
• In the address bar
• In the HTML page

Sessions keep data on the server. The browser holds a random session ID in a cookie.

What protects a database query from SQL injection?

• Joining the input into the query with quotes
• Using strtoupper() on the input
• Prepared statements with placeholders
• Hiding the database password

Prepared statements send the value separately from the SQL command, so input is never run as SQL.

Which functions should you use to store and check passwords?

• password_hash() and password_verify()
• md5() and ==
• base64_encode() and base64_decode()
• strrev() and strlen()

These functions add a random salt and are deliberately slow. md5() is far too weak for passwords.

What should happen to PHP error messages on a live website?

• They should be shown to every visitor
• They should be hidden from visitors and written to a log
• They should be silenced with the @ operator
• They should be stored in a cookie

Error text can reveal file paths and other private details. Log errors for yourself and show visitors a calm message.