The PHP programming language: a complete overview, pros, cons and limits

<?php
declare(strict_types=1);

// order status: the language itself fixes the set of values
enum Status: string
{
    case New = 'new';
    case Paid = 'paid';
    case Shipped = 'shipped';

    public function label(): string
    {
        return match ($this) {
            Status::New     => 'Awaiting payment',
            Status::Paid    => 'Paid',
            Status::Shipped => 'On the way',
        };
    }
}

final class Order
{
    // property hook (PHP 8.4): the total is checked on every write
    public int $total {
        set(int $value) {
            if ($value < 0) {
                throw new InvalidArgumentException('The total cannot be negative');
            }
            $this->total = $value;
        }
    }

    public function __construct(
        public readonly int $id,
        public Status $status = Status::New,
        int $total = 0,
    ) {
        $this->total = $total;
    }
}

$order = new Order(id: 42, total: 1500);
echo $order->status->label(), PHP_EOL;   // Awaiting payment

$order->status = Status::from('paid');
echo $order->status->label(), PHP_EOL;   // Paid

$order->total = -10;                     // InvalidArgumentException

<?php
declare(strict_types=1);

// PHP 8.5: the pipe operator passes a value through the steps left to right
$slug = '  Hello, World! Привет  '
    |> trim(...)
    |> mb_strtolower(...)
    |> (fn(string $s): string => preg_replace('~[^\p{L}\p{N}]+~u', '-', $s))
    |> (fn(string $s): string => trim($s, '-'));

echo $slug, PHP_EOL;                     // hello-world-привет

$orders = [
    ['id' => 1, 'total' => 900],
    ['id' => 2, 'total' => 4200],
    ['id' => 3, 'total' => 7300],
];

// array_first() is also new in 8.5
$firstBig = array_first(array_filter($orders, fn(array $o): bool => $o['total'] > 1000));
echo $firstBig['id'], PHP_EOL;           // 2

<?php
declare(strict_types=1);

$db = new PDO('sqlite::memory:', options: [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
$db->exec('CREATE TABLE users (id INTEGER PRIMARY KEY, email TEXT UNIQUE, hash TEXT)');

// the password is stored only as a hash
$insert = $db->prepare('INSERT INTO users (email, hash) VALUES (:email, :hash)');
$insert->execute([
    'email' => '[email protected]',
    'hash'  => password_hash('correct horse battery staple', PASSWORD_DEFAULT),
]);

// a prepared query: what the user typed stays data and never becomes SQL
$find = $db->prepare('SELECT hash FROM users WHERE email = :email');
$find->execute(['email' => "[email protected]' OR '1'='1"]);
var_dump($find->fetchColumn());          // bool(false): the injection found nothing

$find->execute(['email' => '[email protected]']);
var_dump(password_verify('correct horse battery staple', $find->fetchColumn()));   // bool(true)