PHP interviews cover language semantics, OOP, Laravel or Symfony, MySQL, and web security basics. Below are the most common questions with model answers. Middle: deeper understanding, optimization, and real-world situations.
In Laravel terms, belongsToMany uses a pivot table that exists only to join two models. A has-many-through relationship reaches a distant model via an intermediate one that is a real entity in its own right. If the join table carries its own data — a timestamp, a status — it is a model, and treating it as a pivot is how that data becomes awkward to reach.
One query for a list and one more per item, because a relationship is loaded lazily inside a loop. You find it in the query log or with a package that counts queries per request. with() eager-loads it into a second query. The trap is fixing it by caching the page instead of the query.
It resolves a class's dependencies for you: ask for a type in a constructor and the container builds it, including that type's own dependencies. Binding an interface to an implementation in a provider is what makes the code depend on a contract rather than a concrete class, which is the point of the whole exercise.
Middleware wraps the request and decides whether it continues — authentication, rate limiting, logging. A controller handles the request that made it through. Order matters, and putting authorisation in a controller rather than middleware means every controller has to remember to do it.
The job is serialised to a store, a worker process pulls it and runs it out of band. What has to be true is that it can run twice — the worker may crash after doing the work and before acknowledging it. Anything that sends money or email needs a guard, and long-running jobs need a timeout shorter than the visibility window.
A migration changes schema and is versioned so every environment converges to the same shape. A seeder inserts data — reference rows in production, fake data in development. Putting data changes inside a migration is common and is fine for reference data, but backfilling a large table there blocks the deploy.
SQL injection is prevented by parameter binding, which the query builder and Eloquent do for you — the danger is DB::raw with interpolated input. XSS is prevented by escaping on output, which Blade's {{ }} does and {!! !!} deliberately does not. Both are about not mixing data into a language at the wrong moment.
In a real interview you speak under pressure. Cam asks these same questions, scores every answer, and shows exactly what to fix.
Practice a Middle PHP Backend interview →