Output escaping, loose comparison and string functions

Three habits separate a PHP developer who can be trusted with a live site from one who cannot: escaping on output, comparing with the right operator, and handling strings without off-by-one surprises. Screenings test all three with short snippets.

Escape at the moment of output

$name = '<script>alert(1)</script>';
echo htmlspecialchars($name, ENT_QUOTES, 'UTF-8');
// &lt;script&gt;alert(1)&lt;/script&gt;

Store the raw value and escape when you print it into HTML. Escaping on input corrupts data that is later used in an email or an API. ENT_QUOTES also converts single quotes, which matters inside attributes. Many teams wrap this in a short helper such as e($value) and use it in every template. For a URL use urlencode, and for JSON inside a script tag use json_encode.

Loose versus strict comparison

== converts types before comparing. Since PHP 8 a non-numeric string no longer equals 0, but numeric strings still compare as numbers.

var_dump(0 == "a");        // false (PHP 8)
var_dump("1" == "01");     // true
var_dump("10" == "1e1");   // true
var_dump(null == false);   // true
var_dump("1" === 1);       // false

var_dump(strpos("hello", "h"));           // int(0)
var_dump(strpos("hello", "h") == false);  // true: the trap
var_dump(strpos("hello", "h") === false); // false: correct check
var_dump(in_array("1", [1]));             // true
var_dump(in_array("1", [1], true));       // false
var_dump(empty("0"));                     // true

strpos returns 0 when the needle is at the start, and 0 is loosely equal to false, so always compare its result with === or !==. Pass true as the third argument to in_array and array_search for strict matching. empty() treats the string "0" as empty, so use === '' when zero is a valid input.

String functions that keep appearing

var_dump(strlen("hello"));              // 5
var_dump(trim("  x  "));                // "x"
var_dump(ucfirst("asha"));              // "Asha"
var_dump(str_contains("hello world", "wor"));   // true (PHP 8)
var_dump(substr("screening", 0, 6));    // "screen"
var_dump(sprintf("%05.2f", 3.14159));   // "03.14"
var_dump((int) "12abc");                // 12
var_dump(intdiv(7, 2), 7 / 2);          // 3, 3.5

strlen counts bytes, so use mb_strlen for text that may contain non-Latin characters. / always returns a float when the division is not exact; intdiv gives the integer part. Casting a string to int reads leading digits and stops, which is why filter_var($x, FILTER_VALIDATE_INT) is the safer check for form input.

Common mistakes and a practice habit

• Echoing a database value straight into HTML.
• Writing if (strpos($s, $needle)) and missing matches at position 0.
• Using == to compare a user-supplied token with a stored one; use hash_equals.
• Double escaping, which shows & on the page because the value was escaped on input and again on output.

Practice habit: Keep a file named compare.php with twenty var_dump lines of comparisons you were unsure about. Run it after every PHP upgrade and whenever a test question surprises you. Over a month it becomes a personal answer key for the exact traps screenings use.