Remote PHP Developer Job – 2+ Years Experience

Top 10 Core PHP & Remote Backend Interview Questions

Q1. What is the difference between == and === in PHP, and what changed in PHP 8?
Ans. == compares values after converting types, while === checks both value and type. PHP 8 changed some comparisons, so 0 == "abc" is now false. To avoid subtle bugs, prefer === and enable declare(strict_types=1); in your files.

Q2. How does PHP handle pass-by-value and pass-by-reference?
Ans. By default, values are passed as copies, but PHP uses copy-on-write, so the actual copy is made only when the value is modified. Adding & makes a function change the original variable. Objects are passed as handles, so changing an object’s properties inside a function also changes it outside.

Q3. Why should composer.lock be committed, and what is PSR-4 autoloading?
Ans. composer.lock makes every developer and server install the exact same package versions. PSR-4 maps a namespace to a folder path (for example, App\Services to app/Services), so classes load automatically without manual require statements.

Q4. How should passwords be stored in a database?
Ans. Never store plain text, MD5 or SHA1. Use password_hash($password, PASSWORD_DEFAULT) to create the hash and password_verify() at login. It adds a salt automatically, and password_needs_rehash() lets you upgrade old hashes over time.

Q5. How would you process a CSV with millions of rows without running out of memory?
Ans. Instead of loading the whole file into an array, read it with a generator (yield) that returns one row at a time. Memory use stays almost constant, and this pattern works well with fgetcsv().

Q6. How do you make a file upload feature secure?
Ans. Don’t trust the file extension alone. Check the MIME type on the server, limit the file size, and generate a random file name. Store uploads outside the web root, or in a folder where PHP execution is disabled.

Q7. What is the difference between self:: and static:: (Late Static Binding)?
Ans. self:: always refers to the class where the code is written. static:: resolves at runtime to the class that was actually called, so child class overrides work correctly. It is useful in factory and singleton patterns.

Q8. What is the difference between Exception and Error in PHP, and how can you catch both?
Ans. Since PHP 7, both implement the Throwable interface. Exception is meant for application-level problems, while Error covers engine-level problems such as TypeError. You can catch both with catch (Throwable $e), and use finally for cleanup.

Q9. What roles do OPcache and PHP-FPM play in production performance?
Ans. OPcache keeps compiled bytecode in memory, so scripts are not parsed again on every request. PHP-FPM manages a pool of worker processes, which you tune with settings like pm.max_children based on the server’s available RAM.

Q10. When do you use the 401, 403 and 422 status codes in a REST API?
Ans. Use 401 when the user is not authenticated (a missing or invalid token). Use 403 when the user is logged in but lacks permission. Use 422 when the request is understood but fails validation. Correct status codes make debugging much easier for frontend developers and API consumers.