Glossary

164 terms from PHP Basics, in plain words, each with the chapter that teaches it.

Search the glossary

#

$_COOKIE: A superglobal array holding the cookies the browser sent with the current request, such as the `visits` cookie in Kettle & Crane's counter.
$_GET: A superglobal array holding the values from the URL's query string, so `?name=Dana` gives `$_GET['name']` the value 'Dana'.
$_POST: A superglobal array holding the fields of a form sent with method="post", keyed by each field's name.
$_SERVER: A superglobal array with details about the current request. `$_SERVER['REQUEST_METHOD']` is 'GET' or 'POST', which lets a page tell a first visit from a submitted form.
$_SESSION: A superglobal array holding the current visitor's session data. Whatever you store in it is kept on the server and is there again on the visitor's next request.
$this: Inside a method, a name for the object the method was called on, so `$this->name` is that product's own name.
=== (strict comparison): `===` means equal and the same type, and `!==` means not equal or a different type. `==` converts types first, so `"5" == 5` is true but `"5" === 5` is false; prefer `===`.
?? (null coalescing operator): An operator that gives the value on its left if it exists and isn't null, and the value on its right otherwise. It never warns about a missing key, so it's used to read form input safely.
__DIR__: A constant holding the current file's folder, so `__DIR__ . '/functions.php'` always finds the file next to this one.

A

alternative syntax: A template-friendly way to write control structures in PHP: a colon replaces `{`, and `endif;` or `endforeach;` replaces `}`. It makes it easier to match up blocks inside HTML.
argument: A value you pass to a function when you call it, such as `18.00` and `2` in `lineTotal(18.00, 2)`.
array: A single variable that holds many values, found by index starting from 0 or, in an associative array, by a key you choose.
array_filter(): A function that keeps only the values of an array for which a given function returns true, keeping the keys. Its array comes first, then the function.
array_map(): A function that runs a given function on every value of an array and returns a new array of the results, keeping the keys. Its function comes first, then the array.
arrow function: A one-line form of anonymous function, such as `fn($price) => $price * 0.9`, which returns its expression without a `return` keyword.
assignment: Putting a value into a variable with `=`. Read `$price = 18;` as "price becomes 18"; it replaces any old value and is not a comparison.
associative array: An array that stores each value under a key you choose, written `key => value`, so you can look up `$prices['mug']` by name instead of position.
autoloading: PHP loading a class's file automatically the first time you use the class, so you don't need `require` for each one. Composer sets it up through `vendor/autoload.php`.

B

bin2hex(): A function that turns raw bytes into readable letters and digits. With `random_bytes(16)` it produces a 32-character random token.
block: A group of lines inside curly braces `{ }`, such as the code that runs when an `if` condition is true.
boolean: A type with only two values, `true` or `false`, used for yes-or-no facts.
break / continue: Keywords used inside a loop: `break` leaves the loop at once, and `continue` skips the rest of this pass and goes on to the next one.
browser: The program, such as Chrome, Firefox or Safari, that requests pages from a web server and displays them.
built-in web server: PHP's testing server, started with `php -S localhost:8000 -t today`; `-t` picks the folder to serve. It's for testing only.

C

camelCase: A naming style for several-word names where each word after the first starts with a capital, such as `$mugPrice` or `lineTotal`.
cast: Converting a value to another type by putting the type in brackets before it, such as `(int) "3 bags"`, which gives 3.
catch: The part of a `try` statement that handles an exception of a named class, with the exception object available in a variable such as `$e`.
cd: A terminal command ("change directory") that moves the terminal into a folder, such as `cd Documents/php-basics`.
class: A blueprint that describes a kind of thing: the data it holds (properties) and what it can do (methods). Objects are made from it with `new`.
class constant: A constant declared inside a class with `const`, such as `FREE_SHIPPING` in `Order`, read inside the class as `self::FREE_SHIPPING`, where `self` means "this class".
closure: An anonymous function: a function with no name that can be stored in a variable or passed to another function like a value, as in `$withShipping = function (...) {...};`.
code editor: A program for writing code that colors it and spots mistakes, unlike a plain text editor.
column: One detail in a database table, such as a product's price. Each column has a type like INTEGER, REAL or TEXT.
comment: A note for people that PHP skips. It starts with `//` or `#`, or sits between `/* ... */` for several lines.
Composer: PHP's tool for installing packages (dependencies) into a project's `vendor/` folder and for loading your own classes automatically.
Composer commands (require, install, dump-autoload): `composer require` downloads a package such as `league/csv` into `vendor/`, adds it to `composer.json` and records the version in `composer.lock`. `composer install` downloads exactly the versions in `composer.lock`, and `composer dump-autoload` rebuilds the autoloader from `composer.json`.
composer.json: The settings file Composer reads in a PHP project. It holds the PSR-4 autoload setting that maps a namespace to a folder and, after `composer require`, lists the packages the project depends on.
composer.lock: A file Composer writes that records the exact versions of every installed package, so `composer install` can reproduce them.
constant: A name for a value that never changes while the program runs, written with `const` in capitals and no `$`, such as `FREE_SHIPPING`.
constructor: The method named `__construct` that runs when you create an object with `new`, so every object starts out complete.
constructor property promotion: Writing `public` (or `private`) before a constructor parameter so it also becomes a property, filled from the argument, with no extra code needed.
cookie: A small named value the server asks the browser to store and send back with every later request to the same site. The visitor can change it, so never trust it for anything important.
CSRF (cross-site request forgery): An attack where another site hides a form that posts to your page and tricks a visitor's browser into sending it. A secret CSRF token in your own form defends against it.
CSRF token: A random secret kept in the session and placed in your own form as a hidden input, then checked when the form is posted. A forged form can't know it.
CSV (comma-separated values): A plain-text file format where each line is a row and values are separated by commas, like Kettle & Crane's `products.csv`.

D

database: Organized storage that keeps data after a script ends, made up of tables of rows and columns.
date(): A built-in function that formats the current date or time using letter codes, such as `date('F j, Y')` for "October 23, 2026".
declare(strict_types=1): A line at the top of a file that makes PHP stop with a TypeError when a wrong type is passed to a function, instead of quietly converting it.
default value: A value a parameter gets when the caller leaves that argument out, written like `int $qty = 1`. Parameters with defaults go last.
dependency: A package that your project needs in order to work.
DSN (Data Source Name): The string that tells PDO which database to connect to. For SQLite it's `sqlite:` plus the file path.

E

echo: A PHP keyword that prints what follows it, and can print several values separated by commas.
error_log(): A function that writes a message to PHP's error log, used on a live site so details are kept for you instead of shown to visitors. With `php -S`, the log is the server's terminal window.
error_reporting() / display_errors: Settings that control which problems PHP reports and whether it prints them. Show everything while you build, and turn display off on the live site because messages can reveal file paths.
escaping: Turning special characters such as `<`, `>`, `&` and quotes into codes like `<` so the browser shows them as plain text instead of treating them as HTML. Done with `htmlspecialchars()`.
exception: An object describing a problem that is "thrown" and stops the script unless it is caught with `try`/`catch`.
exit: A statement that stops the script right there, optionally printing a message. It's used after a redirect or a failed token check.
explode() / implode(): `explode()` splits a string into a list at a separator, and `implode()` joins a list into a string with a separator. Both take the separator first.

F

fatal error: A problem that stops the script at once, such as calling a function that doesn't exist.
filter_var(): A function that checks a value's format: it returns the value if valid and `false` if not. Used with filters like `FILTER_VALIDATE_EMAIL` to check an email address.
finally: The part of a `try` statement that runs whether or not an exception happened, used for tidying up.
flash message: A message stored in the session, shown once (usually after a redirect) and then deleted, like the thank-you note after Priya's contact form is sent.
float: A number with a decimal point. Floats are stored in binary, so some decimals aren't exact, which is why you round before showing money.
for loop: A loop that counts: its brackets hold where to start, the condition to keep going and what to do after each pass.
foreach: A loop that runs its block once for each item of an array, putting the current item (and optionally its key) in variables.
framework: A ready-made set of classes that does the routine work of building a site, such as Laravel.
function: A named block of code you write once and run whenever you need it. `return` gives back its result.

G

GET: The HTTP method for asking for a page. Typing an address or clicking a link sends one, and it can carry data in the query string.

H

hash_equals(): A function that compares two strings in a safe way, used to check that the token sent with a form matches the one in the session.
header(): A function that adds an HTTP header to the response, such as `header('Location: /thanks.php');` for a redirect. It must run before any output.
hidden input: A form field, `<input type="hidden">`, that is sent with the form but not shown to the visitor. It carries the CSRF token.
HTML (HyperText Markup Language): The language of web pages, which uses tags such as `<h1>` for a heading and `<p>` for a paragraph.
HTML form: A `<form method="post">` gathers input with fields such as `<input>`, `<textarea>` and `<select>`, and a `<button>` sends it. Each field arrives in PHP as `name=value`.
htmlspecialchars(): The function that escapes `<`, `>`, `&` and quotes so text from outside prints safely in HTML. Most projects wrap it in a short helper called `e()`.
HTTP (HyperText Transfer Protocol): The rules browsers and servers use to talk: a request with a URL and method, and a response. HTTP has no memory between requests, which is why cookies and sessions exist.

I

if statement: A statement that runs a block only when its condition is true. `elseif` and `else` are optional extra branches.
include / require / require_once: Statements that run another PHP file as if pasted in place. `require_once` skips a file already loaded, and `require` stops if the file is missing while `include` only warns.
index: The position of a value in a list array, starting from 0, so `$cart[0]` is the first item.
inheritance: One class taking on the properties and methods of another with the keyword `extends`. `SaleProduct` extends `Product` and can replace its `label()` method, calling the original with `parent::label()`.
integer: A type for whole numbers.
interpolation: PHP replacing a variable inside double quotes with its value, as in `"Hi $name"`. Use braces like `{$qty}` when letters follow the variable.
isset(): A function that checks whether a variable or array key exists and isn't null, so you can avoid warnings about missing keys.

J

JSON (JavaScript Object Notation): A text format web services use to send data to each other. `json_encode()` turns a PHP array into JSON, and Composer's `composer.json` is also written in it.

K

key: The name under which a value is stored in an associative array, written `key => value`.

L

Laravel: The most popular PHP framework, covered in the next book, *Laravel in 50 Pages*. It uses closures and extended classes throughout.
league/csv: A package installed with Composer that reads CSV files, used here to load Kettle & Crane's product list.
localhost: A web address that means "this computer", used with a port to reach the built-in server, as in `http://localhost:8000`.
loop: A construct that repeats a block of code, such as `foreach`, `for` or `while`.

M

match: An expression that compares one value with `===` against several cases and gives back the result of the first match, with `default` for the rest. It's neater than a chain of `elseif`s.
method: A function that belongs to a class or object. A static method is called on the class itself with `::`.

N

named arguments: Passing arguments by parameter name, like `greet(city: 'Seattle', name: 'Marcus')`, so they can come in any order.
namespace: A family name for classes that keeps them apart from same-named ones in other packages, such as `KettleCrane`. Other files import a class with `use`.
new: The keyword that creates an object from a class and runs its constructor, as in `new Product('Mug', 18.00)`.
null: A type with one value, `null`, meaning "no value".
nullable: A type that also allows null, written with a leading `?`, so `?string` means a string or null.
number_format(): A function that turns a number into a string with a set number of decimals and commas between thousands. Use it whenever you show money.

O

object: One thing made from a class, such as a specific `Product` for the Speckled blue mug.
opening tag: `<?php` starts PHP code; PHP only runs what comes after it, so every PHP file starts with it. In a file holding only PHP, leave out the closing tag `?>`.
operator: A symbol that does something with values, such as `+`, `%`, `.`, `===` or `&&`.

P

package: Shared code others can use, such as a library that reads CSV files, installed with Composer.
Packagist: The website (packagist.org) that Composer downloads packages from.
parameter: A variable in a function's definition that receives a value passed in by the caller.
parse error: An error meaning PHP couldn't read the file, so none of it ran, often from a missing `;` or quote. The real mistake is often on the line before the one named.
PDO (PHP Data Objects): PHP's class for talking to databases in the same way whether they are SQLite, MySQL or others.
PDOException: The exception PDO throws when SQL fails, once `ERRMODE_EXCEPTION` is turned on.
PHP: A server-side language for the web: its code runs on the web server, which sends the browser the HTML it builds.
PHPSESSID: The name of the cookie that holds a visitor's random session ID. The browser holds only this ID, while the server keeps the data.
placeholder: A marker that is filled in later. In `printf`, the `%` codes such as `%s` are placeholders; in prepared SQL, `?` or a name like `:max` is filled when you call `execute()`.
port: A numbered door on your computer that a server listens at, such as 8000 in `localhost:8000`.
POST: The HTTP method that sends data to be acted on, such as a submitted form.
Post/Redirect/Get: A pattern where, after a successful POST, the script redirects to another page so the browser makes a fresh GET. Refreshing then doesn't send the form twice.
prepared statement: SQL sent with placeholders (`?` or `:name`) whose values are supplied separately, so input can never be read as SQL. It stops SQL injection.
primary key: A column marked `INTEGER PRIMARY KEY` that numbers rows 1, 2, 3... by itself, giving every row its own `id`.
print_r(): A function that prints a whole array in a readable layout, handy for checking what's inside.
printf() / sprintf(): Functions that fill `%` placeholders such as `%s`, `%d` and `%.2f` in a format string, with widths for aligning columns. `printf` prints the result and `sprintf` returns it.
property: A variable that belongs to an object, such as a product's `name` or `price`.
PSR-4: A standard for autoloading: classes in a namespace live in a mapped folder, one per file, named after the class, so `KettleCrane\Order` is in `src/Order.php`.
public folder (web root): The only folder served to browsers, so class files and the database file kept outside it can't be opened by URL. On shared hosting you upload `public/` as the web root.

Q

query string: The part of a URL after `?`, made of `name=value` pairs joined by `&`. In `?name=Dana`, it is `name=Dana`.

R

random_bytes(): A function that makes the given number of unpredictable bytes, used with `bin2hex()` to create a CSRF token.
readonly: A property marker meaning it can be set once, in the constructor, and never changed. Changing it later is an error.
redirect: A response that tells the browser to load another URL, sent with `header('Location: ...')` followed by `exit`.
request: What a browser sends to a web server asking for a page. It has a URL and a method such as GET or POST.
response: What the web server sends back to the browser, such as the HTML of a page.
return value: The result a function hands back with `return`, or null if it has no `return`.
round(): A function that rounds a number to a given number of decimal places, such as `round(16.456, 2)` giving 16.46.
row: One record in a database table, such as one product or one order.

S

scope: The area where a variable is visible. A function can't see outside variables and its own vanish when it returns, so pass in what it needs. Constants made with `const` are visible everywhere.
server-side: Code that runs on the web server rather than in the browser. The browser receives only the resulting HTML, never your PHP.
session: Data the server keeps for a visitor, found by a random ID stored in a cookie. Anything put in `$_SESSION` is there again on the next request.
session_start(): The function that starts or resumes a visitor's session and loads `$_SESSION`. Call it at the top of every page that uses the session, before any output. `session_regenerate_id()` gives a new ID at login and `session_destroy()` ends the session.
setcookie(): A function that asks the browser to store a cookie, taking a name, a string value and an expiry time. It must run before any output.
shared hosting: A company's server that runs PHP for many small sites, where you upload `public/` as the web root.
short echo tag: The tag `<?= ... ?>`, which prints one value and is short for `<?php echo ... ?>`.
SQL (Structured Query Language): The language for creating, reading and changing data in a database, using commands like CREATE TABLE, INSERT, SELECT and UPDATE.
SQL injection: An attack that slips SQL into input pasted into a query, such as `' OR '1'='1` showing every customer. Placeholders stop it.
SQLite: A database stored in a single file, with no server to install, and included in most PHP installs. It is handy for small projects such as storing Kettle & Crane's products and orders.
statement: One instruction in PHP, ended by a semicolon like a full stop.
static method: A method that belongs to the class rather than to one object, called on the class name with `::`, like `Product::all()`.
string: A piece of text inside quotes. Double quotes interpret variables and `\n`, while single quotes print everything as typed.
string functions: Built-in functions for text, such as `trim()`, `strtolower()`, `str_contains()`, `str_replace()` and `substr()`. They give back a new string and leave the original unchanged.
superglobal: A variable such as `$_GET` that PHP fills in for every script and that is visible everywhere, even inside functions.

T

table: The part of a database that stores rows and columns, like a spreadsheet, such as the `products` table.
template: The HTML part of a PHP file, with small bits of PHP printing values into it.
terminal: A window where you give the computer instructions as text, such as `php hello.php`.
ternary operator: An operator that picks one of two values: `condition ? ifTrue : ifFalse`.
throw: The keyword that raises an exception, stopping the current code. The caller decides what to do, as when `Order` rejects a quantity of 25.
try: A statement that wraps risky code so that, if it throws an exception, PHP jumps to the matching `catch` block instead of stopping.
type: The kind of value something is. PHP's five basic types are integer, float, string, boolean and null.
type declaration: A note saying what type a parameter must be and what a function returns, such as `float $price` and `: string`. `: void` means it returns nothing.
type juggling: PHP quietly converting a value to another type when needed, such as `"5" + 3` giving 8. It's handy for form input, but can surprise you when comparing values.
TypeError: The error PHP throws in strict mode when a value of the wrong type is passed to a function.

U

unset(): A function that removes a variable or an array key, such as removing a flash message after showing it.
URL (Uniform Resource Locator): The address of a page, which every request carries.
use: A statement that imports a class from a namespace so you can write its short name, such as `use KettleCrane\Product;`. PHP's own classes need it too inside a namespace.

V

validation: Checking input before you use it, such as trimming it, requiring fields and testing formats with `filter_var()`, then collecting problems in an `$errors` array.
var_dump(): A function that shows a value's type as well as the value, the quickest way to check what a variable really holds.
variable: A named box that holds a value. In PHP every variable name starts with `$`.
visibility (public, private): Visibility says who may use a property or method: `public` is open to all code, `private` only to the class's own methods.
VS Code: Visual Studio Code, a free code editor that colors code and helps spot mistakes. With the PHP Intelephense extension installed, it also gives help with PHP.

W

warning: A message meaning something looks wrong but PHP carries on running, such as reading a missing array key.
web server: The computer that receives a browser's request and sends back a response such as an HTML page. PHP code runs there.
while loop: A loop that repeats while its condition is true, so something inside must eventually change it or the program never stops.

X

XSS (cross-site scripting): An attack that sneaks code, such as a `<script>`, into a page through unescaped input so it runs in a visitor's browser. Escaping output prevents it.