What is PHP and what is it used for?

Browser and server: two different places

Every web page is created in two places. One is your device: that is where the browser runs, displays text, reacts to clicks and executes JavaScript. The other is the server: a machine in a data centre that many people access at the same time. That is where the data lives, where the rules apply, and where PHP runs.

This separation is not a technicality; it is the reason behind almost all the properties of web applications. Whatever happens in the browser can be altered by any visitor — it is a program running on their device. Whatever happens on the server stays under your control. That is why price calculation, permission checks and anything that must be binding belong on the server.

What PHP does during a request

PHP is started when a request arrives and ends when the response has been written. In between, the real work happens: validating input, clarifying permissions, reading or writing data, querying other systems and assembling the response.

This sequence repeats for every request that actually reaches PHP. Not every delivery does: images, stylesheets and cached pages are served by the web server directly, without starting PHP. Where that line runs is decided by the architecture of the application. PHP remembers nothing between two requests; whatever needs to persist is kept in a database or in the user's session. That sounds cumbersome, but it has a practical advantage: an error in one request does not affect the next, and a server can handle a great many requests side by side.

Where PHP is used today

PHP is found in web applications that process data and model business processes. We come across three groups most often in everyday work:

• Business applications for your own company: portals for customers or employees, data entry forms, planning and approval processes.
• Shops and content management systems: many widely used systems are written in PHP and are customised through extensions.
• Interfaces and background work: transferring data between systems, importing files, preparing reports, sending emails.

For our own work, the third group is the most interesting: it is rarely shown, yet accounts for a large part of the benefit. You can see a user interface; you notice a working data transfer by the fact that nobody has to enter data twice any more.

Where PHP is not the right choice

PHP is built for requests that are answered and completed. For permanently open connections, such as a chat with instant delivery to many participants, or for very compute- and memory-intensive long-running jobs, there are often better-suited tools. PHP can indeed be run as a long-running process for these purposes, but that requires a different architecture from the usual request model. Anything that needs to react immediately in the browser also remains the job of JavaScript.

In practice, this is rarely an either-or question. An application usually consists of a PHP application for the business logic, JavaScript for the user interface and a few additional services for special tasks.

Why the version matters

PHP continues to be developed, and each version receives security updates for only a limited time. Which versions those currently are is published by the project itself — the list below links to it. If an application runs on an unsupported version, it no longer receives security fixes. This is the most common reason why a working application still needs work.