final class Class1 {
    // ...
}

class FatalClass extends Class1 {
    // ...
}

$out= new FatalClass();

An Abstract class will never be a final class as an abstract class must be extendable.

Consider the following code snippet. Is this code acceptable from a security standpoint?
Assume that the $action and $data variables are designed to be accepted from the user and
register_globals is enabled.

<?php
if(isUserAdmin()) {
 $isAdmin = true;
}
$data = validate_and_return_input($data);
switch($action){
 case 'add':
 addSomething($data);
 break;
case 'delete':
 if($isAdmin) {
 deleteSomething($data);
 }
break;
case 'edit':
 if($isAdmin) {
 editSomething($data);
 }
break;
default:
print “Bad Action.”;
}
?>

A. Yes, it is secure. It checks for $isAdmin to be True before executing protected operations
B. No, it is not secure because it doesn’t make sure $action is valid input
C. No, it is not secure because $isAdmin can be hijacked by exploiting register_globals
D. Yes, it is secure because it validates the user-data $data
E. Both A and B

The correct answer is C. This code is, by any means, not secure! In fact, it is the classic security exploit of PHP scripts using the register_globals configuration directive. The problem lies in the $isAdmin variable: although this is clearly a Boolean value, it is only set in the event that the user is an Admin and not set at all if the user is not. Because register_globals is enabled, by simply appending that variable to the end of the URL as a GET parameter, a malicious user could easily impersonate an administrator:

http://www.example.com/action.php?action=delete&data=foo&isAdmin=1

Which of the following will not combine strings $s1 and $s2 into a single string?


$s1 = 'a';
$s2 = 'b';
A. $s1 + $s2
B. "{$s1}{$s2}"
C. $s1.$s2
D. implode('', array($s1,$s2))
E. All of the above combine the strings

You can not concatenate 2 string using “+”. The answer will be “0″; so here the answer is A.

$alpha = 'abcdefghijklmnopqrstuvwxyz';
$letters = array(15, 7, 15);
foreach($letters as $val) {
/* What should be here */
}

A. echo chr($val);
B. echo asc($val);
C. echo substr($alpha, $val, 2);
D. echo $alpha{$val};
E. echo $alpha{$val+1}

An array can be accessed like this as well. $alpha{$val}

What will out put the following code snippet?

<?php
$who = "questions";
echo <<<TEXT
So I said, "php interview $who"
TEXT;
?>

Answer – So I said, “php interview questions”

In general, the functionality of this heredoc syntax is similar to double quotes.

In a php interview, even a well experienced php programmer might forget how this works,
For an example,
a) echo “Hello $what\n”;
b) echo ‘Hello $what\n’;
$what = “World”;

Which will print correctly in to the browser as “Hello World” followed by a new line.
Is it a) or b) ?

The answer is “a”. That is because simple string will print almost all characters literally, where complex string allows special escape sequences to insert special characters.

class a{
function a(){
echo ‘aaaa’;
}
}

class b extends a{
function b(){
echo ‘bbbb’;
parent::a();
}
}
new b;

The basic idea what we have to identify in this code snippet is,  whether the function names work as constructors or not?
Yes, first it will call the function b and then it will call the function a. Which will out put,
bbbbaaaa

rsort() – Where it resets key associations as well.
arsort() – Where it sorts in descending order, while keeping the key associations as well.

The main difference is that sort() will sort an array without concerning it’s key associations while asort() will maintain it’s key association as well.

$array = array(‘a’=>’foo’,'b’=>’bar’,'c’=>’baz’);
asort($array);
print_r($array);

Array
(
[b] => bar
=> baz
[a] => foo
)

- Make register_globals to off to prevent Form Injection with malicious data.

- Set Error_reporting to E_ALL so that all variables will be intialized before using them.

- Practice of using htmlentities(), strip_tags(), utf8_decode() and addslashes()  for filtering malicious data in php

- Make practice of using mysql_escape_string() in mysql.

session_register() is used for register one or more global variables with the current session. While $_SESSION[] array is used for storing one or more variables with in the current session array. session_register() depends upon register_global is enable

$result = mysql_query($any_valid_sql, $database_link);
$num_rows = mysql_num_rows($result);
echo “$num_rows rows found”;

mysql_pconnect establishes a persistent connection. If you don’t need one (such as a website that is mostly HTML files or PHP files that don’t call the db) then you don’t need to use it. mysql_connect establishes a connection for the duration of the script that access the db. Once the script has finished executing it closes the connection. The only time you need to close the connection manually is

1. Using mysql_fetch_row function. This will return an indexed array.
2. Using mysql_fetch_array function. Fetch a result row as an associative array, a numeric array, or both.
3. Using mysql_fetch_object function. This will return the result set as an object.
4. Using mysql_fetch_assoc function. This will Fetch a result row as an associative array