The server-side language that runs most of the web.
PHP is a server-side programming language built specifically for the web. While JavaScript runs in the visitor's browser, PHP runs on the web server: when someone requests a page, the server executes your PHP code - reading a database, checking a login, processing a form - and sends back the resulting HTML.
It powers a huge share of the web (WordPress alone runs on PHP),
and its killer feature for beginners is deployment:
PHP comes pre-installed on virtually every shared hosting
plan. Upload a .php file and it just runs -
no server processes to manage, no configuration.
PHP is the most practical choice when you're on shared hosting or building a traditional website - pages rendered on the server, a contact form, a small database-backed site. It pairs naturally with MySQL, which the same hosts also provide. If you're building a JavaScript-heavy single-page app or want one language across frontend and backend, Node.js may fit better.
<?php ... ?> tags in otherwise normal HTML
files. The server runs the code and the visitor only ever sees
the output.
$_POST and $_GET; sessions
($_SESSION) carry data between requests.
$; PHP's array type doubles as both list and
dictionary and is used everywhere.
htmlspecialchars() before printing it, so it can't
inject scripts into your page.
<?php
$name = $_GET["name"] ?? "world";
$hour = (int) date("H");
$greeting = $hour < 12 ? "Good morning" : "Hello";
?>
<!doctype html>
<html>
<body>
<h1><?= htmlspecialchars("$greeting, $name!") ?></h1>
</body>
</html>
Save this as hello.php on any PHP host, visit
hello.php?name=Sam, and the server builds the page for
that visitor on the fly.
php -S localhost:8000 in your project folder for an
instant dev server.
date() and an
if statement to greet visitors differently by time
of day.
<?php - stops you setting cookies or redirecting. In files that contain only PHP, leave off the closing ?> tag.
== converts types in surprising ways. Use === unless you specifically want conversion.
mysql_* functions. They were removed in PHP 7. Use PDO with prepared statements.
htmlspecialchars() every time.
PHP runs on virtually every shared hosting plan: upload your files to public_html and they work. In the control panel, select the newest PHP version available, enable the free SSL certificate, and make sure errors are logged rather than displayed. If your plan includes SSH access, you can run Composer on the server too.
Our PHP + MySQL guide builds and uploads a complete, secure example.