PHP interviews cover language semantics, OOP, Laravel or Symfony, MySQL, and web security basics. Below are the most common questions with model answers. Middle: deeper understanding, optimization, and real-world situations.
A trait is a block of methods and properties that can be composed into a class, working around PHP's single inheritance. An interface declares a contract with no implementation; inheritance gives an is-a relationship with one parent; a trait gives reusable implementation without a type relationship. Conflicts between traits must be resolved explicitly with insteadof or as.
Single Responsibility: a class has one reason to change, so a controller does not also build PDFs. Open/Closed: extend behaviour through new classes rather than editing existing ones. Liskov: a subclass must be usable wherever the parent is. Interface Segregation: many small interfaces beat one fat one. Dependency Inversion: depend on interfaces injected into the constructor, not on concrete classes created with new.
The container resolves class dependencies automatically by reflecting on constructor type hints and instantiating what is needed recursively. You bind interfaces to concrete implementations in a service provider, so swapping an implementation is a one-line change. Singleton bindings share one instance per request lifecycle, which matters for stateful services like a connection pool.
A prepared statement sends the SQL structure and the parameters separately, so user input is never parsed as SQL and quoting mistakes cannot become an injection. In PHP that means PDO or mysqli with bound parameters, or an ORM that does it for you. String concatenation into a query is the vulnerability; escaping functions are a fragile substitute because they depend on charset and context.
Eloquent is Laravel's active-record ORM where each model maps to a table and relationships are defined as methods. N+1 happens when you loop over models and touch a relation, firing one query per row. The fix is eager loading with with(), and you can catch it in development by enabling Model::preventLazyLoading() so a lazy access throws instead of silently degrading.
Middleware wraps the HTTP request pipeline, letting you run code before or after the controller — authentication, rate limiting, CORS headers, logging. Each middleware receives the request and a $next closure, decides whether to pass it along, and can modify the response on the way back. Because it composes, cross-cutting concerns stay out of controllers.
PSR-4 maps a namespace prefix to a directory, so App\Services\Mailer resolves to src/Services/Mailer.php. Composer generates an autoloader from the mapping in composer.json and registers it with spl_autoload_register, so classes load on first use instead of being required manually. In production you run composer dump-autoload --optimize to build a static class map and skip filesystem lookups.
XSS injects executable script into a page — prevented by escaping all output with htmlspecialchars or Blade's double braces, plus a Content Security Policy. CSRF tricks an authenticated browser into submitting a request the user did not intend — prevented by a per-session token on every state-changing form and SameSite cookies. The key distinction is that XSS abuses trust in the site, CSRF abuses the site's trust in the browser.
In a real interview you speak under pressure. Cam asks these same questions, scores every answer, and shows exactly what to fix.
Practice a Middle PHP Backend interview →