PHP Interview Questions to Ask Before You Hire

12 PHP interview questions — with what to listen for

1. 1

   What has changed in PHP over the 8.x line that you actually use daily, and how has it changed your code?

   What a strong answer covers

   Concrete adoption: constructor property promotion, enums, readonly properties, union types, named arguments, attributes, match expressions, fibers awareness. The framing matters — candidates should connect features to eliminated bug classes (type errors, boilerplate), not recite release notes.

2. 2

   Explain PHP's execution model per request and what OPcache and preloading change about it.

   What a strong answer covers

   Share-nothing request lifecycle — code compiled then discarded per request — with OPcache keeping compiled bytecode in memory and preloading pinning framework code. Understanding this model explains PHP scaling behavior and why memory leaks matter less but cold starts matter more than in daemon runtimes.

3. 3

   How do you prevent SQL injection, XSS, and CSRF in PHP — and where have you seen each still slip through in modern codebases?

   What a strong answer covers

   Prepared statements always, context-aware output escaping, framework CSRF tokens. The slip-through half is the test: raw queries in report code, echo of user data in admin panels, API endpoints excluded from CSRF middleware improperly. Security answered as habit plus audit, not just mechanism.

4. 4

   Walk me through type declarations in modern PHP — strict_types, union and intersection types — and your position on how strictly to type a codebase.

   What a strong answer covers

   declare(strict_types=1) semantics, parameter/return/property types, and a reasoned stance: strict at boundaries and domain code, with static analysis (PHPStan or Psalm at meaningful levels) doing the enforcement runtime types cannot. Static-analysis fluency is the modern professional marker.

5. 5

   How does Composer autoloading work, and how do you structure a project's namespaces and packages?

   What a strong answer covers

   PSR-4 mapping namespaces to directories, the autoloader's role, semantic versioning and lockfile discipline, and when to extract internal packages. Private-package tooling (Satis, private Packagist, monorepo paths) appears in answers from people who have run larger PHP estates.

6. 6

   A PHP page renders in four seconds. Take me through your diagnosis in order.

   What a strong answer covers

   Profiling first — Xdebug profiles, Blackfire, or APM — then the ladder: N+1 queries and missing indexes, over-eager ORM hydration, external API calls in-request, missing caches, OPcache misconfiguration. Ordered, measure-first methodology beats a list of generic optimizations.

7. 7

   How do you run background and asynchronous work in PHP given its request-bound model?

   What a strong answer covers

   Queues with workers (framework queues, RabbitMQ/Redis-backed), cron-scheduled jobs, and supervisord-managed long-running consumers with memory-restart hygiene. Awareness of newer async runtimes — Swoole, RoadRunner, FrankenPHP — with honest scoping of when they pay is a currency signal.

8. 8

   You inherit a 300k-line PHP 5.6 application with no tests that the business depends on daily. What are your first ninety days?

   What a strong answer covers

   Stabilize and observe: version-control hygiene, staging environment, error tracking, characterization tests on money paths. Then incremental modernization: PHP version stepping with compatibility tooling (Rector), strangler-pattern extraction, no big-bang rewrite pitch. This question predicts success in half the PHP jobs that exist.

9. 9

   Compare the PHP frameworks you know — Laravel, Symfony, or others — and tell me when you would pick each or none.

   What a strong answer covers

   Laravel for product velocity and ecosystem, Symfony for component architecture and long-horizon enterprise work, micro or no framework for tiny services. Judgment shown by matching to team and product rather than tribal loyalty; knowing Symfony components underpin much of the ecosystem is depth.

10. 10

    What is your testing approach in PHP, and how do you retrofit tests onto untested code?

    What a strong answer covers

    PHPUnit or Pest, in-memory or containerized databases, mocking at architectural seams. Retrofit strategy: characterization tests capturing current behavior, breaking hidden dependencies (globals, statics, superglobals) via seams, testing around bugs before fixing. Legacy-testing literacy is rare and valuable in PHP hiring.

11. 11

    How do sessions, cookies, and authentication state work in PHP, and what mistakes have you found in session handling?

    What a strong answer covers

    Session lifecycle and storage backends (files versus Redis for multi-server), cookie flags — HttpOnly, Secure, SameSite — session fixation and regeneration on privilege change, and timeout policy. Finding session data trusted as authorization without re-checking is the classic audit story worth hearing.

12. 12

    How would you scale a PHP application from one server to many — what breaks first?

    What a strong answer covers

    Local sessions break (move to shared store), local file uploads break (object storage), cron duplication (locks or a scheduler), cache coherence, and database as the eventual bottleneck with read replicas and query work. The breaks-first framing tests whether they have actually done it.

Frequently asked questions