Web Technology II

Pass path: Master PHP basic syntax, difference between echo/print, include vs require, and reading GET/POST superglobals. Top path: Explain PHP request processing lifecycle, variable scope rules, passing arguments by reference, and superglobal security hygiene.

Part 1: Core Concepts (2 Marks)

★ Server-Side Scripting: Code executed on the web server before the HTML payload is transmitted to the client browser, generating dynamic, database-driven markup while concealing application logic and credentials from the end user. ★ include vs require: Both statements embed and evaluate the specified external file; include emits a non-blocking E_WARNING if the file is missing and continues execution, whereas require throws a fatal E_COMPILE_ERROR halting execution immediately. ★ Variable Scope in PHP: The visibility context of variables, categorized into local (inside function), global (outside functions, accessible via global $var or $GLOBALS['var']), and static (retains value between successive function calls).

Part 2: Structural Frameworks (10 Marks)

PHP Request Execution Architecture and Scripting Fundamentals

• Request-Response Lifecycle:
  1. Client sends HTTP request for .php script to web server (Apache/Nginx).
  2. Web server routes request to PHP Preprocessor engine via FastCGI/mod_php.
  3. PHP engine compiles script into Zend opcodes, executes business logic, queries database if required, and produces standard HTML/JSON output.
  4. Web server sends raw HTTP response payload back to browser; PHP runtime state is destroyed.

PHP Request Lifecycle Diagram

• Language Constructs and Control:
  • Superglobals: Predefined associative arrays available across all scopes ($_SERVER, $_GET, $_POST, $_FILES, $_COOKIE, $_SESSION, $_REQUEST, $GLOBALS).
  • Strict Control Flow:

    <?php
    // Function with reference parameter and type hinting
    function applyTax(float &$amount, float$taxRate = 0.13): float {
        $tax =$amount * $taxRate;
        $amount +=$tax;
        return $tax;
    }
    $total = 1000.00;
    $taxPaid = applyTax($total); // $total is now 1130.00
    ?>
    

• Best Practice Inclusion: Always use require_once 'config.php'; for database credentials and core library dependencies to prevent duplicate class definition crashes.

Part 3: Distinction Tables

Part 4: Worked Problems & Exam Traps

• Easy: What is the difference between echo and print in PHP?
  • Answer: echo can accept multiple comma-separated arguments and has no return value; print accepts only a single argument and always returns 1 (allowing it to be used in expressions). echo is marginally faster.
• Exam-level: Write a PHP snippet using foreach to iterate over an associative array of employee names and their salaries, displaying only those with salary $> 25000$.
  • Answer:

    $salaries = ["Ram" => 20000, "Sita" => 35000, "Hari" => 40000];
    foreach ($salaries as$name => $salary) {
        if ($salary > 25000) {
            echo "Employee: " . htmlspecialchars($name) . " - Salary: Rs. " .$salary . "<br>";
        }
    }
    

• Twist variant: In PHP, what happens if you access an undefined variable inside a function without declaring it global?
  • Answer: PHP generates an E_WARNING (or Notice in older versions) for an undefined variable and treats its value as null.

Students lose marks here because they assume include_once prevents fatal errors when a file is missing (it only prevents duplicate inclusions; it still emits a warning, while require_once throws a fatal error).

Server-Side PHP Execution Architecture and Superglobals

PHP operates as an interpreted, server-side scripting language embedded within web servers:

1. The PHP Processing Lifecycle:
   • Client browser issues an HTTP request to the web server (Apache / Nginx).
   • The web server delegates .php script execution to the PHP-FPM / Zend Engine.
   • PHP parses, compiles bytecode, executes business logic, communicates with database engines, and outputs pure HTML/JSON to the server, which streams it back to the client.
2. PHP Superglobal Arrays:
   • $_GET: Captures URL query parameters (/index.php?category=books&page=2). Publicly visible in browser history; never use for passwords or sensitive state changes.
   • $_POST: Captures form data transmitted within the HTTP request body; used for idempotent or destructive operations (login, create, update).
   • $_SERVER: Contains server environment variables, HTTP headers, client IP ($_SERVER['REMOTE_ADDR']), and script paths ($_SERVER['PHP_SELF']).
   • $_SESSION: Stores user session data server-side across requests, identified via client-side cookie PHPSESSID.
   • $_COOKIE: Retrieves cookies transmitted by the client browser.

• Session Fixation and Hijacking Defenses:

  • Attackers intercept or preset a user’s session identifier to gain unauthorized access.
  • Mitigations:
    • Call session_regenerate_id(true) immediately upon successful user login to invalidate the pre-authentication session ID.
    • Set session cookie flags: HttpOnly = true (blocks JavaScript access), Secure = true (restricts transmission to HTTPS), and SameSite = Strict (mitigates CSRF).

• HTTP Header Management and Output Buffering in PHP:

  • Functions modifying HTTP headers (such as header('Location: /dashboard.php') or setcookie()) must be invoked before any HTML or whitespace output is sent to the client browser.
  • Using Output Buffering (ob_start() and ob_end_flush()) captures generated content in a memory buffer, preventing premature header dispatch errors.