PHP interviews cover language semantics, OOP, Laravel or Symfony, MySQL, and web security basics. Below are the most common questions with model answers. Senior: architecture, trade-offs, mentoring, and decision-making.
The container resolves class dependencies automatically by reflecting on constructor type hints and instantiating what is needed recursively. You bind interfaces to concrete implementations in a service provider, so swapping an implementation is a one-line change. Singleton bindings share one instance per request lifecycle, which matters for stateful services like a connection pool.
A prepared statement sends the SQL structure and the parameters separately, so user input is never parsed as SQL and quoting mistakes cannot become an injection. In PHP that means PDO or mysqli with bound parameters, or an ORM that does it for you. String concatenation into a query is the vulnerability; escaping functions are a fragile substitute because they depend on charset and context.
Eloquent is Laravel's active-record ORM where each model maps to a table and relationships are defined as methods. N+1 happens when you loop over models and touch a relation, firing one query per row. The fix is eager loading with with(), and you can catch it in development by enabling Model::preventLazyLoading() so a lazy access throws instead of silently degrading.
Middleware wraps the HTTP request pipeline, letting you run code before or after the controller — authentication, rate limiting, CORS headers, logging. Each middleware receives the request and a $next closure, decides whether to pass it along, and can modify the response on the way back. Because it composes, cross-cutting concerns stay out of controllers.
PSR-4 maps a namespace prefix to a directory, so App\Services\Mailer resolves to src/Services/Mailer.php. Composer generates an autoloader from the mapping in composer.json and registers it with spl_autoload_register, so classes load on first use instead of being required manually. In production you run composer dump-autoload --optimize to build a static class map and skip filesystem lookups.
XSS injects executable script into a page — prevented by escaping all output with htmlspecialchars or Blade's double braces, plus a Content Security Policy. CSRF tricks an authenticated browser into submitting a request the user did not intend — prevented by a per-session token on every state-changing form and SameSite cookies. The key distinction is that XSS abuses trust in the site, CSRF abuses the site's trust in the browser.
include emits a warning and continues if the file is missing; require raises a fatal error and stops. The _once variants track already-loaded files and skip duplicates, which prevents redeclaration errors. In modern code all four are mostly irrelevant because Composer autoloading handles class loading, and explicit includes remain only for config or template files.
In a real interview you speak under pressure. Cam asks these same questions, scores every answer, and shows exactly what to fix.
Practice a Senior PHP Backend interview →