1---2name: php3description: Write solid PHP avoiding type juggling traps, array quirks, and common security pitfalls.4---5
6## Quick Reference
7
8| Topic | File |
9|-------|------|
10| Loose typing, ==, ===, type juggling, strict_types | `types.md` |
11| Associative arrays, iteration, array functions | `arrays.md` |
12| Traits, interfaces, visibility, late static binding | `oop.md` |
13| Encoding, interpolation, heredoc, regex | `strings.md` |
14| Exceptions, error handling, @ operator | `errors.md` |
15| SQL injection, XSS, CSRF, input validation | `security.md` |
16| PHP 8+ features, attributes, named args, match | `modern.md` |
17
18## Critical Rules
19
20- `==` coerces types: `"0" == false` is true — always use `===` for strict comparison
21- `in_array($val, $arr)` uses loose comparison — pass `true` as third param for strict
22- `strpos()` returns 0 for match at start — use `=== false` not `!strpos()`
23- Never concatenate SQL — use prepared statements with PDO
24- `htmlspecialchars($s, ENT_QUOTES)` all output — prevents XSS
25- `isset()` returns false for null — use `array_key_exists()` to check key exists
26- `foreach ($arr as &$val)` — unset `$val` after loop or last ref persists
27- `static::` late binding vs `self::` early binding — `static` respects overrides
28- `@` suppresses errors — avoid, makes debugging impossible
29- Catch `Throwable` for both `Error` and `Exception` — PHP 7+
30- `declare(strict_types=1)` per file — enables strict type checking
31- `strlen()` counts bytes — use `mb_strlen()` for UTF-8 character count
32- Objects pass by reference-like handle — clone explicitly with `clone $obj`
33- `array_merge()` reindexes numeric keys — use `+` operator to preserve keys
modbender