HowToCodePage

PHP variables and strings

Dynamic typing, interpolation, heredoc, and the loose-comparison quirks that cause real security bugs.

Variables

$count = 10;              // no declaration keyword
$price = 19.99;
$label = "cart";
$active = true;
$nothing = null;

echo gettype($count);      // integer
var_dump($count);          // type + value, best for debugging

Variables are dynamically typed and prefixed with $. Since PHP 7 you can also declare strict types per file with declare(strict_types=1); — strongly recommended in new code.

Strings

$name = "Ada";
echo "Hello $name";            // double quotes interpolate
echo 'Hello $name';            // single quotes do not
echo "Sum: {$arr['total']}";   // braces when the expression is ambiguous

$multi = <<<TEXT
Line one
Line two: $name
TEXT;

echo nl2br(htmlspecialchars($multi));
FunctionPurpose
strlenLength in bytes (see mb_strlen for Unicode)
str_containsSubstring test (PHP 8+)
str_replaceReplace all occurrences
trimStrip surrounding whitespace
sprintfFormat into a string
htmlspecialcharsEscape for HTML output

Loose versus strict comparison

var_dump(0 == "a");     // false in PHP 8 (was true in PHP 7!)
var_dump("1" == "01");  // true  - numeric strings compared numerically
var_dump("10" == "1e1");// true
var_dump(100 == "1e2"); // true

var_dump("1" === 1);    // false - type differs
⚠️
Use === everywhere, especially in authentication and permission checks. PHP 8 fixed the worst == surprises, but loose comparison remains a footgun. For password checks use password_verify(), never ==.

FAQ

What is the difference between isset, empty and null checks?
isset is false for null; empty is true for 0, "", [] and null. Pick deliberately — they answer different questions.
How do I handle Unicode safely?
Use the mb_* family (mb_strlen, mb_substr) and set default_charset = UTF-8.

PHP: getting started PHP arrays

Last refreshed 2026-09-17.