Run a mock round

== compares values after type juggling, while === compares value and type without coercion.

0 == 'abc';   // false in PHP 8 (true in PHP 7 and earlier)
'1' == 1;     // true
'1' === 1;    // false
null == false;// true
0 == '';      // false in PHP 8

PHP 8 changed the comparison rules to be more intuitive, but the secure and predictable choice is almost always ===. Loose comparison has caused real security bugs, for example in authentication checks and the classic magic hash issue.

Never concatenate user input into SQL. Use prepared statements with bound parameters, which separate code from data.

$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email AND active = 1');
$stmt->execute([':email' => $email]);
$user = $stmt->fetch();

Also:

• Use PDO or mysqli with emulation disabled (PDO::ATTR_EMULATE_PREPARES => false).
• Validate and whitelist anything that cannot be bound, such as column names or ORDER BY direction.
• Apply least privilege to the database user and escape output with htmlspecialchars for XSS.
• Store passwords with password_hash and verify with password_verify.

• include: includes a file; on failure emits a warning and execution continues.
• require: includes a file; on failure emits a fatal error and stops.
• include_once / require_once: same, but skip the file if it was already included, preventing redeclaration errors.

Use require for essential files (configuration, classes) and include for optional templates. In modern projects, Composer autoloading replaces most manual includes, and require_once is rarely needed outside bootstrap code.

Output escaping encodes user-controlled data at the moment it is written into HTML so browsers treat it as text, not markup. This is the primary defence against XSS.

echo htmlspecialchars($comment, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');

Rules:

• Escape on output, not on input. Store raw, encode per context (HTML, attribute, URL, JavaScript).
• Use a templating engine that auto-escapes (Twig, Blade, Laravel) to avoid forgetting.
• Combine with a Content-Security-Policy header that disallows inline scripts.
• Do not rely on strip_tags alone; it is not sufficient.

For attributes use ENT_QUOTES; for URLs use rawurlencode; inside script blocks prefer JSON encoding.

Modern PHP uses exceptions. Throwable is the root interface with two branches: Error (engine-level, e.g. TypeError, DivisionByZeroError) and Exception (application-level).

try {
  risky();
} catch (ValidationException $e) {
  // handle
} catch (Throwable $e) {
  // fallback
  error_log($e->getMessage());
} finally {
  // always runs
}

Best practice: convert warnings to exceptions with set_error_handler, configure error_reporting(E_ALL), log errors rather than echo them, and never expose stack traces to users in production. Use a global handler via set_exception_handler and register_shutdown_function for fatal errors.

Sessions persist state across stateless HTTP requests. session_start() creates or resumes a session identified by a cookie (PHPSESSID) and stores data server-side.

Security checklist:

• Regenerate the ID on privilege change: session_regenerate_id(true) after login to prevent session fixation.
• Set cookie flags: HttpOnly, Secure, and SameSite=Lax or Strict.
• Use session.use_strict_mode to reject unknown IDs.
• Store sessions outside the web root or in Redis for scale.
• Add CSRF tokens to state-changing forms.
• Set an idle timeout and destroy sessions on logout with session_destroy().

For APIs, prefer stateless tokens (JWT or opaque tokens) over PHP sessions.

Composer is PHP's dependency manager. It reads composer.json, resolves a version graph and writes composer.lock to pin exact versions for reproducible installs. composer install uses the lock file; composer update re-resolves it.

The autoload section generates a class map so you do not require files manually:

• PSR-4 maps a namespace prefix to a directory, e.g. "App\\": "src/". The class App\Foo\Bar loads from src/Foo/Bar.php.
• classmap scans directories; files always includes a file.
• composer dump-autoload -o builds an optimised classmap for production.

Include vendor/autoload.php at the entry point and namespaces resolve automatically.