PHP is a general-purpose scripting language designed for web development. It runs on the server, generates HTML or other output and sends it to the browser. A large share of the web is built with PHP, including WordPress, the most widely used content management system, and large frameworks such as Laravel and Symfony.

A short history

PHP was created in 1994 by Rasmus Lerdorf as a small set of tools for his personal home page. That is where the original name, "Personal Home Page Tools", came from. Today the name is a recursive acronym: PHP: Hypertext Preprocessor.

Over the years, PHP grew into a full programming language:

• PHP 3 (1998) – a rewrite by Andi Gutmans and Zeev Suraski that made PHP a real language.
• PHP 4 (2000) – introduced the Zend Engine.
• PHP 5 (2004) – brought a much better object-oriented model.
• PHP 7 (2015) – a major performance improvement and scalar type declarations. Version 6 was abandoned and never released.
• PHP 8 (2020) – a just-in-time (JIT) compiler, named arguments, union types, match expressions and attributes, followed by further 8.x releases.

PHP is free and open source, developed by a community of contributors and supported by the PHP Foundation.

How it works

A typical PHP request looks like this:

1. The browser asks for a page, for example /products.
2. The web server passes the request to PHP.
3. PHP runs the script: it can read from a database, process a form or call an API.
4. The script produces output, usually HTML.
5. The server sends the output back to the browser.

PHP code can sit right inside an HTML template:

<?php
$name = "World";
?>
<h1>Hello, <?= htmlspecialchars($name) ?>!</h1>

Modern applications usually keep the logic and the templates separate, with a framework handling routing and other plumbing.

The ecosystem

• Composer – the standard dependency manager. It installs libraries from Packagist, the main package repository.
• Frameworks – Laravel and Symfony are the best known. Others include CodeIgniter, CakePHP and Laminas.
• Content management systems – WordPress, Drupal and Joomla, plus many e-commerce platforms such as WooCommerce, Magento (Adobe Commerce) and PrestaShop.
• Testing – PHPUnit and Pest.
• Static analysis – PHPStan and Psalm find bugs before the code runs.
• PSR standards – the PHP-FIG group publishes shared recommendations (PSRs) for coding style, autoloading, interfaces and more, so libraries from different authors work together.

Strengths

• Built for the web – handling requests, forms, sessions and cookies is part of the language.
• Easy to deploy – supported by almost every web host.
• Huge ecosystem – mature frameworks, libraries and a big community.
• Fast – PHP 7 and 8 are much faster than the older versions that gave PHP its slow reputation.
• Shared-nothing model – every request starts clean, which keeps applications simple and easy to scale horizontally.

Common criticism

PHP has long been criticised for inconsistent function names and argument order, loose type comparisons and many old tutorials that teach insecure practices. Much of this is history: modern PHP has strict types, a solid object model and good tools, and a well-written PHP 8 codebase looks very different from the code of the early 2000s.

Good practices

• Use a supported PHP version – old versions stop receiving security fixes.
• Turn on strict types (declare(strict_types=1);) and use type declarations.
• Use prepared statements (PDO) for database queries, to prevent SQL injection.
• Escape output (htmlspecialchars) to prevent cross-site scripting (XSS).
• Manage dependencies with Composer and keep them up to date.
• Follow the PSR-12 coding style and run static analysis in your workflow.

Official sources

• PHP: https://www.php.net/
• Composer: https://getcomposer.org/
• Packagist: https://packagist.org/