Server-Side Scripting with PHP: Forms, Superglobals and Output
What this domain tests
PHP runs on the server and sends generated HTML to the browser, so the visitor never sees the source code. It needs a PHP-enabled server such as Apache with the PHP module, commonly installed together in XAMPP. Questions cover syntax, form handling, superglobals, includes and sessions.
Syntax essentials
Files use the .php extension and code sits inside the PHP opening and closing tags. Variables begin with $, need no type declaration and are case-sensitive. Single quotes are literal; double quotes interpolate variables. Strings join with the dot operator, not with +. Output uses echo or print. Arrays can be written with array(...) or [...], and foreach walks them. Superglobals: $_GET carries query-string data (visible in the URL, length-limited), $_POST carries body data (hidden from the URL, needed for passwords and uploads), $_SERVER gives request details, and $_SESSION and $_COOKIE hold state. include warns and continues when the file is missing; require stops with a fatal error. Call session_start() before touching $_SESSION.
Worked example
A form posts with method='post' action='process.php' and an input named name. In process.php, the script checks $_SERVER['REQUEST_METHOD'] equals 'POST', reads $_POST['name'] into a variable, passes it through htmlspecialchars() to neutralise markup, and echoes 'Hello, ' concatenated with the value. Marks come from the method check, the right superglobal, sanitising and correct concatenation.
Traps
- Dropping the $ or a semicolon; PHP will not run the line.
- Joining strings with +, which triggers arithmetic instead.
- Reading $_GET for a password, exposing it in the URL and logs.
- Echoing user input without htmlspecialchars(), opening cross-site scripting.
- Using $_SESSION before session_start().
- Confusing include (warning) with require (fatal error).