PHP Programming Cheatsheet: Modern PHP 8.x, OOP, PDO & MySQL Guide

Step 1: Modern PHP 8.x Breakthrough Features

<?php
declare(strict_types=1);

// 1. Constructor Property Promotion & Union Types
class Course {
    public function __construct(
        public string $title,
        public int|float $fee,
        public ?string $duration = '3 Months' // Nullable type
    ) {}
}

$dca = new Course(title: "DCA", fee: 4999); // Named Arguments

// 2. Match Expression (replaces verbose switch statements)
$statusCode = 200;
$message = match ($statusCode) {
    200, 201 => 'Success: Request Handled',
    400 => 'Bad Request: Missing Parameters',
    404 => 'Not Found: Resource does not exist',
    default => 'Internal Server Error'
};

// 3. Nullsafe Operator (?->)
$studentCity = $student?->profile?->address?->city ?? 'Unknown';

Step 2: Bulletproof PDO Database Prepared Statements

Never concatenate raw user input into SQL queries. Always utilize PDO prepared statements with bound parameters:

<?php
$dsn = "mysql:host=localhost;dbname=seo_pragati;charset=utf8mb4";
$options = [
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
    PDO::ATTR_EMULATE_PREPARES   => false,
];

try {
    $pdo = new PDO($dsn, "db_user", "db_password", $options);

    // Secure Prepared Statement: Prevents 100% of SQL Injection attacks
    $stmt = $pdo->prepare("SELECT id, name, fee FROM courses WHERE slug = :slug AND status = :status");
    $stmt->execute([
        'slug' => 'tally-prime-course',
        'status' => 'active'
    ]);
    
    $course = $stmt->fetch();
    echo $course ? "Found: " . htmlspecialchars($course['name']) : "Not found";
} catch (PDOException $e) {
    error_log($e->getMessage());
    die("Database connection failed. Please try again later.");
}

Step 3: Web Application Security Standards (OWASP)

• Password Hashing: Always use password_hash($password, PASSWORD_BCRYPT). Never use MD5 or SHA1. Verify with password_verify($input, $hash).
• XSS Prevention: Always escape dynamic HTML output using htmlspecialchars($var, ENT_QUOTES, 'UTF-8').
• CSRF Protection: Generate a cryptographically secure random token in $_SESSION['csrf_token'] = bin2hex(random_bytes(32)) and validate it on every POST request.