• What is PHP?
• Uses of PHP
• Where it is used?
• History of PHP
• Basics of PHP
• An Example
• Security Issues
What is PHP?What is PHP?
• PHP: Hypertext Preprocessor
• Originally called “Personal Home Page Tools”
• Popular server-side scripting technology
• Anyone may view, modify and redistribute source
• Supported freely by community
• Platform independent 3
• Source-code not visible by client
• ‘View Source’ in browsers does not display the PHP code
• Various built-in functions allow for fast
• PHP supports many databases (MySQL,
Informix, Oracle, Sybase, Solid, PostgreSQL,
Generic ODBC, etc.)
• PHP is compatible with almost all servers
used today (Apache, IIS, etc.)
PHP FeaturesPHP Features
• Easy learning
• Syntax Perl- and C-like syntax. Relatively easy to
• Large function library
• Embedded directly into HTML
• Interpreted, no need to compile
• Open Source server-side scripting language
designed specifically for the web.
PHP Features(cont.)PHP Features(cont.)
• Conceived in 1994, now used on +10 million web
• Outputs not only HTML but can output XML,
images (JPG & PNG), PDF files and even Flash
movies all generated on the fly. Can write these
files to the file system.
• PHP also has support for talking to other services
using protocols such as LDAP, IMAP, SNMP,
NNTP, POP3, HTTP.
Using PHP you..
• Can performs system functions, i.e. from files on a system
it can create, open, read, write, and close them.
• Can handle forms, i.e. gather data from files, save data to
a file, thru email you can send data, return data to the
• Can add, delete, modify elements within your database
• Access cookies variables and set cookies.
• Can restrict users to access some pages of website.
• Can encrypt data.
Where it is used..?
• Project Management Tools
• Graphical User Interface
• Building an Online Community
• Developing Facebook Applications
• Generating PDF Files
• Mailing Lists
• Image Processing and Generation
History of PHPHistory of PHP
• PHP began in 1995 when Rasmus Lerdorf developed a
Perl/CGI script toolset he called the Personal Home Page
• PHP 2 released 1997 (PHP now stands for Hypertext
Processor). Lerdorf developed it further, using C instead
• PHP3 released in 1998 (50,000 users)
• PHP4 released in 2000 (3.6 million domains). Considered
debut of functional language and including Perl parsing,
with other major features
• PHP5.0.0 released July 13, 2004 (113 libraries>1,000
functions with extensive object-oriented programming)
• PHP 6 is yet to released
• The PHP language was originally implemented as an interpreter
• Several compilers have been developed which decouple the
PHP language from the interpreter.
• Advantages of compilation include better execution speed,
static analysis, and improved interoperability with code written
in other languages.
• Phalanger, which compiles PHP into Common Intermediate
Language (CIL) byte code, and HipHop, developed at Facebook
and now available as open source, which transforms the PHP
Script into C++, then compiles it, reducing server load up to 50%
• PHP scripts can also be deployed in executable format using
a PHP compiler.
• Structurally similar to C/C++
• Supports procedural and object-oriented paradigm (to
• Scripting delimiters
• <? php ?>
• Must enclose all script code
• Variables preceded by $ symbol
• End statements with semicolon
• // for single line
• /* */ for multiline
• Filenames end with .php by convention
•Operators are used to operate on values. There are
four classifications of operators:
In PHP, there are three kind of arrays:
• Numeric array
• Associative array
• Multidimensional array
• Wide Variety available
• if, else, elseif
• while, do-while
• for, foreach
• break, continue, switch
• require, include, require_once, include_once
PHP Hello World
•Above is the PHP source code.
PHP Hello World
•It renders as HTML that looks like this:
• About 30% of all vulnerabilities listed on the National
Vulnerability Database are linked to PHP.
• These are caused mostly by not following best practice
programming rules; technical security flaws of the language
itself or of its core libraries are not frequent (23 in 2008,
about 1% of the total).
• Recognizing that programmers make mistakes, some
languages include taint checking to automatically detect the
lack of input validation which induces many issues.