Kerala Plus Two Computer Science (DHSE): PHP and Server-Side Scripting

PHP and Server-Side Scripting

This domain tests how a server executes PHP, handles form data, and interacts with databases securely.

Server-side basics

• PHP runs on the web server; the browser receives only the generated HTML, never the PHP source.
• A PHP block starts with <?php and ends with ?>; statements end with ;.
• Variables begin with $ and are loosely typed: $name = 'Anu';.
• echo/print send output to the HTML response.

Forms and superglobals

• $_GET collects query-string data; $_POST collects body data from a POST form.
• isset() checks whether a value exists; empty() checks for unset/empty values.
• include and require insert another file; require fails fatally if missing.
• Sessions (session_start(), $_SESSION) preserve state across requests; cookies store small client-side values.

Database and security

• Connect with mysqli or PDO, run a query, fetch rows.
• Validate input and use prepared statements to prevent SQL injection. Escape output with htmlspecialchars() to reduce XSS.

Worked example

$name = $_POST['name'] ?? ''; echo 'Hello, ' . htmlspecialchars($name); Reasoning: ?? supplies a fallback when the key is absent; concatenation uses .; htmlspecialchars neutralises HTML characters so user input cannot inject markup.

Traps

• Expecting PHP to be visible in page source.
• Using $_GET for a form posted with method='post'.
• Concatenating input directly into SQL, creating an injection risk.
• Forgetting session_start() before using $_SESSION.
• Using . for addition; PHP uses + for arithmetic.