1. Basics
   1. Syntax
      1. Punctuation
         1. Terminate code statements with a semi-colon (;)
         2. Use appropriate tags
      2. Tags
         1. <?php ... ?>
         2. <script language="php"> ... </script>
      3. Comments
         1. // ...
         2. /* ... */
      4. Arithmetic Operators
         1. + (adding)
         2. - (subtracting)
         3. * (multiplying)
         4. / (dividing)
         5. % (modulus)
      5. Bitwise Operators
         1. AND &
         2. OR |
         3. EITHER-OR ^
         4. Shift bits << x or >> x
         5. Negate bits ~
      6. Assignment Operators
         1. Assign =
         2. Assign (arrays) =>
         3. Short Forms
            1. $a += 1 equals to $a = $a + 1
            2. $a .= 'World!';
         4. Increase / Decrease ++ --
         5. Comparison Operators
            1. Equality ==
            2. Inequality !=
            3. Identical ===
            4. Unidentical !==
            5. > < >= <=
         6. Array Operators
            1. Union +
            2. Equal ==
            3. Identical ===
            4. Not equal !=
            5. Not equal <>
            6. Not identical !==
         7. Logical Operators
            1. and
            2. or
            3. xor
            4. not (!)
            5. && (and)
            6. || (or)
         8. Execution Operators
            1. `command`
            2. shell_exec();
   2. Operators
   3. Variables
      1. Naming
         1. start with $
         2. letters, numbers, and underscores
         3. case-sensitive
      2. Referencing
         1. assigned by value
         2. assigned by reference (&)
      3. Initializing
         1. check with isset()
   4. Control Structures
      1. Conditions
         1. if
         2. else
         3. elseif (else if)
         4. if-else (ternary operator)
            1. (expression) ? value_if_true : value_if_false
         5. switch
      2. Loops
         1. while
         2. do-while
         3. for
         4. foreach
         5. continue
         6. break
   5. Language Constructs & Functions
      1. Output Constructs
         1. die(), exit()
         2. echo(), print()
         3. return()
      2. Evaluation Constructs
         1. empty()
         2. eval()
         3. include(), include_once()
            1. failure in execution leads to a warning
         4. require(), require_once()
            1. failure in execution leads to a fatal error
      3. Other Constructs
         1. isset()
            1. determine wheter a variable has been set (not null)
         2. unset()
            1. use to unset the variable
         3. list()
            1. use to assign a group of variables in one step
   6. Constants
      1. Naming
         1. start with a letter or underscore
         2. case-sensitive
         3. by convention use only uppercase letters
      2. Access
         1. defined and eaccessed anywhere
         2. must be defined before use
         3. cannot be changed subsequently
      3. Predefined Constants
         1. "Magic" Constants
            1. __XXX__
            2. can change depending upon where used
         2. E_ERROR, TRUE, FALSE, ...
   7. Namespaces
      1. Use
         1. prevent accidentally re-defining functions, classes, etc.
         2. avoids having to use long class names
         3. constants, classes, and functions are affected by the use of namespaces
         4. sub-namespaces to sub-divide a library
      2. Declaring Namespaces
         1. namespace at the beginning of the code file
         2. one namespace per code file
         3. unless a namespace is defined => global space
         4. "\" => global space
         5. Subtopic 5
      3. Importing / Aliasing Namespaces
         1. "use" operator
         2. can create aliases
   8. Extensions & AJAX
      1. PECL
         1. added to the php.ini
      2. Core Extensions
         1. part of the php core
         2. arrays, objects, ...
      3. Userland Rules
         1. Global Namespace Constructs
         2. Internal Naming
            1. functions use underscores between words
            2. classes use the cameCase rule
            3. double underscore prefix is reserved
   9. Configuration
      1. php.ini
         1. configuration file for php
         2. file run upon server starting
         3. search order
            1. sapi
            2. phprc
            3. Registry
            4. Working Directory
            5. Directory
            6. Win Directory
      2. user.ini
         1. processed by CGI/FastCGI SAPI
         2. PHP_INI_PERDIR or PHP_INI_USER
         3. controlled by directives
            1. user_ini.filename
            2. user.cache_ttl
      3. Settings
         1. ini_set() -> php.ini / httpd.conf
   10. Performance
       1. Factors Affecting Performance
          1. reduced memory usage
          2. run-time delays
       2. Garbage Collection
2. Data types & formats
   1. XML Basics
      1. Extensible Markup Language
   2. XML Extension
      1. Create a XML parser
         1. xml_parser_create()
         2. xml_parser_create_ns()
         3. xml_set_element_handler()
      2. Character encodings
         1. Source encoding
            1. conducted at time of parsing
            2. cannot be changed during parser lifetime
            3. types
            4. UTF-8
            5. US-ASCII
            6. ISO-8859-1
         2. Target encoding
            1. conducted at time of php passing data to xml handlers
            2. can be changed at any time
         3. Characters not capable of source encoding cause an error
         4. Characters not capable of target encoding are demoted to "?"
   3. SimpleXML
      1. Concept
         1. elements become object properties
         2. attributes can be accessed via associative arrays
      2. Functions
         1. $xml = simplexml_load_string('<?xml ...');
         2. $xml = simplexml_load_file('file.xml');
         3. $xml = new SimpleXMLElement('<?xml..');
   4. Xpath
      1. query language used to select nodes within an XML document
      2. xpath('//');
         1. executes the query
   5. Web Services Basics
   6. SOAP
      1. Simple Object Access Protocoll
   7. REST
      1. Definition
         1. Representational State Transfer
         2. uses only HTTP
         3. stateless
         4. exposes URIs
         5. transfers XML, JSON, or both
      2. REST uses HTTP "verbs"
         1. GET - list
         2. GET - resource
         3. POST - create
         4. PUT - update
         5. DELETE - delete
   8. JSON & AJAX
      1. Definition
         1. JavaScript Object Notation
         2. data-interchange format
      2. Functions
         1. json_decode()
         2. json_encode()
         3. json_last_error()
   9. Date & Time
      1. Runtime Configuration
         1. date.default_latitude
         2. date.timezone
   10. DOM
       1. uses UTF-8 encoding
       2. simplexml_import_dom()
          1. converts DOM node into a SimpleXML object
       3. dom_import_simplexml()
          1. converts a SimpleXML object into a DOM
3. Strings & patterns
   1. Quoting
      1. delimited by single or double quotes
      2. single quotes '
      3. double quotes "
   2. Comparing
      1. ==
         1. sets up comparison
         2. including data type conversion
      2. ===
         1. sets up comparison
         2. data type check
      3. strcasecmp()
      4. strcmp()
      5. similar_text()
         1. similarity of two strings
         2. returns the number of matching chars
      6. levenshtein()
         1. Levenshtein distance between strings
   3. Extracting
      1. explode()
         1. converts a string into an array
      2. implode()
         1. converts an array into a string
      3. Substrings
         1. string substr ( string $string , int $start [, int $length ] )
         2. returns a substring position
   4. Formatting
      1. output
         1. printf()
         2. sprintf()
         3. vprintf()
         4. vsprintf()
         5. fprintf()
      2. characters
         1. binary (%b)
         2. decimal (%d)
         3. float (%f)
         4. octal (%o)
         5. scientific notation (%e)
         6. string (%s)
         7. n digits (%nd)
         8. n decimal places (%.nf)
   5. Regular expressions
      1. POSIX-RegEx
      2. PCRE
         1. Perl Compatible Regular Expression
         2. Delimiter
            1. "/", "#", "!"
            2. used at the beginning and end
         3. Boundaries
            1. start of a line (^)
            2. end of a line ($)
            3. start of a string (\A)
            4. end of a string (\Z)
         4. Character classes
            1. [..]
            2. built-in classes
            3. \d
            4. \D
         5. Quantifiers
            1. 0 or more (*)
            2. 1 or more (+)
            3. 0 or 1 (?)
            4. combination of ? with * or + makes non-greedy
   6. Heredoc & Nowdoc
      1. Nowdoc Syntax
         1. <<< 'IDENTIFIER'
         2. IDENTIFIER;
         3. parsing is conducted
      2. Heredoc Syntax
         1. no need to escape
         2. <<< IDENTIFIER
         3. IDENTIFIER;
         4. do not indent ending identifier or add any chars
   7. Matching
      1. Locating strings
         1. int strpos ( string $haystack , mixed $needle [, int $offset = 0 ] )
      2. Counting strings
         1. strlen()
         2. str_word_count()
      3. Phonetic functions
         1. soundex()
         2. metaphone()
4. Arrays
   1. Enumerated Arrays
      1. $x = array('a', 'b', 'c');
      2. $y = array(0 => 'a', 1 => 'b', 2 => 'c');
      3. indexed numerically
   2. Associative Arrays
      1. indexed with strings
      2. $x = array('xml' => 'eXtensible Markup Language');
   3. Array Operations
      1. Filling Arrays
         1. range();
         2. default step is "1"
         3. $x = range(1.2, 4.1);
      2. Splitting Arrays
         1. array array_slice ( array $array , int $offset [, int $length [, bool $preserve_keys = false ]] )
         2. negative offset means count from the end of the array
         3. negative length exlude elements x positions from the end of the array
         4. x = array(1, 2, 3, 4, 5);
         5. $y = array_slice($x, - 4, - 1); // array(2, 3, 4)
      3. Adding Elements
         1. int array_push ( array &$array , mixed $var [, mixed $... ] )
         2. alternatively $n[] = 5;
         3. int array_unshift ( array &$array , mixed $var [, mixed $... ] )
      4. Removing Elements
         1. mixed array_pop ( array &$array )
            1. remove 1 element at the end of an array
            2. return value is the removed element
         2. mixed array_shift ( array &$array )
            1. remove 1 element at the beginning of an array
            2. remaining elements are moved towards the front
            3. return value is the removed element
   4. Array Iteration
      1. for
         1. loop and indices
         2. for ($i = 0; $i < count($a); $i++) { print $a[$i]; }
      2. foreach
         1. loop and value
         2. loop and keys and values
      3. array_walk();
   5. Array Functions
      1. Checking For Array Values
         1. bool array_key_exists ( mixed $key , array $search )
         2. bool in_array ( mixed $needle , array $haystack [, bool $strict ] )
         3. array array_keys ( array $input [, mixed $search_value [, bool $strict = false ]] )
         4. array array_values ( array $input )
      2. Sorting Arrays
         1. bool sort ( array &$array [, int $sort_flags = SORT_REGULAR ] )
         2. rsort()
         3. asort()
         4. arsort()
         5. ksort()
         6. krsort()
         7. usort()
         8. natsort()
      3. Merging Arrays
         1. array array_merge ( array $array1 [, array $array2 [, array $... ]] )
      4. Comparing Arrays
         1. array_diff($x, $y)
         2. array_diff_assoc()
         3. array_diff_uassoc()
         4. array_diff_key()
         5. array_diff_ukey
5. Input/Output
   1. Files
      1. f*();
         1. work with a file resource
         2. fopen();
      2. file*();
         1. functions that work with a filename
         2. file_get_contents();
      3. Filesystem Functions
         1. resource fopen ( string $filename , string $mode [, int $use_include_path [, resource $zcontext ]] )
            1. create a resource
         2. string fread ( resource $handle , int $length )
            1. read from resource
         3. int fwrite ( resource $handle , string $string [, int $length ] )
            1. write into resource
         4. int fputs ( resource $handle , string $str [, int $length ] )
         5. int fpassthru ( resource $handle )
            1. ouput all data of a file handle directly to the output buffer
   2. Streams
      1. Parts of a data stream
         1. wrapper
         2. pipelines
         3. context
         4. meta data
      2. Wrappers
         1. file://
         2. http://
         3. https://
         4. ftp://
         5. ftps://
         6. compress.bzip2://
         7. compress.zlib://
         8. php://
      3. Custom wrappers
         1. stream_wrapper_register(protocol, classname);
   3. Contexts
      1. additional information for a stream
      2. stream_context_create();
      3. stream_context_set_params();
      4. stream_context_get_options();
   4. Filesystem
      1. Directory
         1. chdir()
            1. changes the directory
         2. chroot()
            1. changes the root directory
         3. readdir()
            1. reads an entry from the directory handle
         4. rmdir()
            1. deletes a directory
      2. File Information
         1. finfo_open()
            1. create a new fileinfo-resource
         2. finfo_file()
            1. returns information about a file
      3. Filesystem
         1. basename()
            1. returns filename component of a path
         2. chmod()
            1. changes the file mode
         3. copy()
            1. copies a file
         4. delete()
            1. deletes a file
         5. file_exists()
            1. checks if a file or directory exists
         6. rename()
            1. moves/renames a file
         7. unlink()
            1. deletes a file
   5. Filters
      1. can be applied to stream data
         1. resource stream_filter_append ( resource $stream , string $filtername [, int $read_write [, mixed $params ]] )
      2. can create custom filters
         1. bool stream_filter_register ( string $filtername , string $classname )
6. Functions
   1. Syntax
      1. case-insensitive
      2. global scope
      3. can be referenced before being defined
      4. types
         1. built-in
         2. user-defined
         3. externally provided
      5. declaration
         1. parameters and return value optional
         2. set param default to avoid warning
   2. Arguments
      1. func_num_args()
         1. number of parameters
      2. func_get_arg(nr)
         1. parameter value number nr
      3. func_get_args()
         1. all parameters as an array
      4. argument list is a set of comma-delimited expression
      5. pass arguments
         1. by value (default)
            1. creates copy
            2. argument changes extend only within function
         2. by reference
            1. & to supply parameters by reference
   3. Variable Functions
      1. work like variable variables
      2. variables followed by parentheses causes search for, and execution of, function with the same name
      3. used for callbacks, function tables
   4. Returns
      1. return()
      2. ends function execution
      3. will return values that include arrays, objects, function references (using &)
   5. Variable Scope
      1. variables declared within functions only visible in that function
      2. variables declared outside of functions can be made visible within a function using "global"
   6. Closures
      1. functions without a name
      2. used for callback functions
      3. to inherit variables from parent scope (function in which closure was declared), these variables must be declared in function header
7. OOP
   1. Objects
      1. converting to strings
         1. __toString()
         2. called whenever a string is expected
            1. print
            2. string interpolation
            3. operation with strings
            4. calling function that expect strings
      2. copying objects
         1. keyword: clone
         2. objects are always passed by reference
         3. shallow cloning by default
         4. __clone()
      3. serializing objects
         1. functions
            1. serialize()
            2. unserialize()
         2. __sleep() is executed with serialization
            1. allows you to specify which properties should be stored
            2. can also create/change properties
         3. __wakeup() is executed with deserialization
            1. open a database connection for example
   2. Instantiation
      1. keyword: new
      2. an object is created unless it has a constructor defined that throws an exception with an error
      3. assigning an existing instance of a class to a new variable => reference
   3. Class Definition
      1. keyword: class
      2. defines the abstract characteristics of an object
      3. properties and methods are called "members"
      4. structure
         1. class CLASSNAME { CONSTANTS, PROPERTIES & METHODS }
   4. Constructors / Destructors
      1. __construct()
         1. used with new objects as preparation for initialization
      2. __destruct()
         1. close open handles
         2. called whenever an object is destroyed
   5. Properties
      1. also called attributes
      2. visibility keywords: public, protected, private
      3. must be with a constant value
         1. nowdocs can be used to initialize a property
   6. Class Constants
      1. a special entity that remains fixed on an individual class basis
      2. no $ symbol
      3. $classname::CONSTANT
      4. ClassName::$varConstant
   7. Methods
      1. set of procedural statements
      2. default visibility is public
      3. context-object -> $this
   8. Static Methods & Properties
      1. keyword: static
      2. operator: ::
         1. token that permits access to the static, constant, or overridden properties / methods of a class
         2. self:: refers to the current class
         3. parent:: refers to the parent of the current class
      3. no instantiation required
      4. CLASSNAME::$varMethod
   9. Magic Methods
      1. __get() reads a property
      2. __set() writes a property
      3. __isset() check if the property is set
      4. __unset() unsets or destroys a property
      5. __call accessing non-existent methods
      6. __callStatic() calling of non-existent static methods
   10. Late Static Binding
       1. used for retrieving the caller class information when static call to inherited method is made
   11. Type Hinting
       1. data types
          1. classes
          2. arrays
       2. if the data type does not match => fatal error
       3. class type matches exactly or extendedly
   12. Reflection
       1. allows for introspection of
          1. objects
          2. classes
          3. methods
          4. properties
          5. functions
          6. parameters
          7. exceptions
          8. extensions
   13. Autoload
       1. __autoload()
       2. called whenever there is an attempt to use a class or interface that has not been defined
       3. spl_autoload() is used as an implementation for __autoload()
   14. Exceptions
       1. keyword: throw
       2. catch with try ... catch
          1. may also wait for specific exceptions
          2. type my be an exception extended from another
       3. custom exceptions need to extend the base Exception class
   15. Interfaces
       1. keyword: interface, implements
       2. provides methods to implement
       3. no implementations!
       4. derived classes my implement more than one interface
       5. interfaces may inherti from other interfaces (keyword: extends)
       6. methods are public
   16. Inheritance
       1. keyword: extends
       2. a class can inherit from only one class
       3. inherited methods and properties can be overridden by redeclaring them with the same name
       4. child classes cannot override a parent property or method using a lower visibility
       5. classes and methods marked with final cannot be overridden
   17. Abstract Classes
       1. keyword: abstract
       2. provides a skeleton for a class
       3. my contain implementations
       4. abstract methods must be implemented in derived classes
8. Databases
   1. SQL
      1. Create a database table
         1. CREATE TABLE tblname ( ... )
      2. Read data
         1. SELECT field1, field2 FROM tblname WHERE field3 = 'desiredValue'
         2. SELECT * FROM tblname ORDER BY field1 ASC
         3. SELECT * FROM tblname ORDER BY field1 DESC
         4. SELECT field1, field2 FROM tblname GROUB BY field1
      3. Insert data
         1. INSERT INTO tblname (field1, field2, field3) VALUES ('V1', 'V2', 3);
      4. Update data
         1. UPDATE tblname SET field1 = 'valueNew1', field2 = 'valueNew2' WHERE field3 = 'valueOld3'
      5. Delete data
         1. DELETE FROM tblname WHERE field1 = 'value1'
         2. DROP TABLE tblname
         3. DROP DATABASE dbname
   2. Joins
      1. Inner join
      2. Left join
      3. Right join
   3. Prepared Statements
      1. advantages
         1. query only parsed once
         2. multiple executions with same or different parameters
         3. better performance
   4. Transactions
      1. combines individual SQL operations into one
      2. usually start with BEGIN or BEGIN TRANSACTION
      3. execute the transaction using COMMIT
      4. cancel the transaction using ROLLBACK
   5. PDO
      1. PHP Data Objects Extension
      2. data-access abstraction layer
      3. must use database-specific PDO adapter to access a db server
      4. operations
         1. create an instance of the PDO class
         2. PDOStatement PDO::query ( string $statement )
      5. transactions
         1. PDO::beginTransaction()
         2. PDO::commit()
         3. PDO::rollBack()
      6. PDOStatement
         1. only values can be bound
         2. PDO::prepare()
         3. PDOStatement::execute()
   6. Keys
      1. Primary Key: column of unique values that describe an entry in the data table
      2. Foreign Key: primary key from another table; enables relational databases
   7. Aggregation
      1. average value AVG()
      2. number of elements COUNT()
      3. number of distinct elements DISTINCT COUNT()
      4. minimal value MIN()
      5. maximal value MAX()
      6. sum of values SUM()
9. Security
   1. Configuration
      1. General settings
         1. register_globals set to OFF
         2. display_errors set to OFF
         3. log_errors set to ON
         4. allow_url_include set to OFF
         5. error_reporting = E_ALL & ~E_DEPRECATED
      2. Filesystem security
         1. only allow limited permissions to the apache web user binary
         2. check all variables submitted
   2. Sessions
      1. Session hijacking
         1. occurs when the session id is stolen
         2. session id is the sole authentication token for the whole web site
      2. Session fixation
         1. occurs when user gets a fixed session id
      3. Counter-measures
         1. regenerate the session ID upon login
         2. use SSL encryption for the login or assign a hidden key
         3. check that the ip address remains the same
         4. session_regenerate_id() before "critical" operations
         5. use short session timeout
         6. provide user logout
         7. destroy the original session by passing TRUE (session_regenerate_id(true);)
         8. session.use_only_cookies ON
   3. Cross-Site-Scripting
      1. Description
         1. injection of HTML, CSS, or script code into a page
         2. JavaScript is particularly dangerous
            1. redirect the user
            2. modify the page
            3. read out cookies
      2. Counter-measures
         1. escape all data before outputting it
            1. htmlspecialchars()
            2. htmlentities()
            3. strip_tags()
   4. Cross-Site Request Forgeries
      1. Description
         1. creates HTTP requests
         2. attacker employs user's browser to execute requests on the attacker's behalf
      2. Counter-measures
         1. use unique token in the form
         2. re-login before sensitive operations
   5. SQL injections
      1. Description
         1. SQL code is injected into the SQL query
         2. allows attacker to do almost anything the database user is permitted
      2. Counter-measures
         1. use prepared statements
         2. escape all data
   6. Remote Code Injection
      1. Description
         1. run the attacker's code on a user's machine
         2. Include file attacks
            1. possible from remote servers
            2. includes remote code execution
      2. Counter-measures
         1. check data against a whitelist
         2. remove paths using basename()
         3. set allow_url_fopen = Off in php.ini
         4. do note use system()
         5. escapeshell*()
   7. Email injection
      1. make sure not to provide open relays
      2. open the smtp prot only if essential
   8. Input filtering
      1. use the same charset for filtering as the target procedure
      2. convert charsets prior to filtering
      3. use filters
   9. Escaping output
      1. 1) filter and validate all input
      2. 2) escape output
      3. 3) never rely on client side filtering
   10. Encryption, hashing, algorithms
       1. Password security
          1. do not save passwords in cleartext
          2. use hash values
             1. md5() / 32 characters, hexadecimal
             2. sha1() / 40 characters, hexadecimal
   11. File uploads
       1. file name can be forged
          1. use checks and basename()
       2. MIME can be forged
          1. ignore
       3. temp file name can be forged under certain conditions
          1. use *_uploaded_file() functions
10. Web Features
    1. Sessions
       1. Definition
          1. way of preserving data across a series of web site accesses by the user
          2. session support is enabled by default
          3. SID(string) is a pre-defined constant for this extension
       2. Session ID
          1. user assigned a unique identifier
          2. session id is stored in a cookie on the client or in the url
          3. site access by user triggers session id check
             1. session.auto_start = 1
             2. session_start()
       3. $_SESSION (super global)
       4. enable session.use_only_cookies for data protection
       5. Session Functions
          1. session_cache_expire() return current cache expire
          2. session_destroy() destroys all data registers to a session
          3. session_id() get/set current session id
          4. session_start() initialize session data
    2. Forms
       1. General
          1. form elements are automatically available to PHP scripts
          2. form data can be made into an array
             1. <input name"array[]" />
          3. dots (.) and spaces ( ) are converted to underscores (_)
       2. Superglobal Arrays
          1. $_POST
          2. $_GET
          3. $_REQUEST ($_POST/$_GET/$_COOKIE)
          4. $_FILES
    3. Cookies
       1. create cookies with setcookie() or setrawcookie()
          1. must be called before sending any output
          2. can delay script output using output buffering
       2. access with $_COOKIE or $_REQUEST
          1. cookies are part of the HTTP header
          2. to assign all values to only one cookie, can use serialize() or explode() with first value
    4. HTTP Headers and Code
       1. header()
          1. sets an http header
       2. headers_list()
          1. list of headers sent or to be sent; indexed array
       3. headers_sent()
       4. header_remove()
       5. Header Codes
          1. 1XX Informational
          2. 2XX Successful
          3. 3XX Redirection
          4. 4XX Error (Client)
          5. 5XX Error (Server)
       6. HTTP Authentication
          1. PHP_AUTH_USER User
          2. PHP_AUTH_PW Password
          3. AUTH_TYPE Authentication type