JavaScript.CodeCompared.To/PHP

A file that is nothing but PHP conventionally omits the closing ?>, because any whitespace after it is sent to the browser and will break a later header() call. echo is a language construct rather than a function, so echo "a", "b"; is legal; print is the expression-valued cousin, and var_dump is the debugging one that shows types.

Your Node process stays up between requests, so visitCount keeps climbing until you redeploy — which is why a leak matters, why module-level caches work, and why one bad request can take down every other. A PHP request starts a fresh interpreter, runs your file, sends the output and throws everything away: the next request sees visit 1 again. Anything that must survive goes to a session, a cache like Redis, or the database. That single fact explains most of what follows.

There is exactly one visitor in a PHP process, so a synchronous read delays that visitor and nobody else. This is why file_get_contents, PDO queries and curl_exec are all blocking calls with no promise in sight, and why PHP code reads top to bottom with no callbacks, no await, and no function colouring. The cost is paid elsewhere: concurrency comes from running many processes, so the tuning knob is a worker-pool size in PHP-FPM instead of an event loop.

$_GET, $_POST, $_SERVER, $_COOKIE, $_FILES and $_SESSION are visible in every scope without being passed or imported, because there is only ever one request in the process to confuse them with. Modern frameworks wrap them in a Request object precisely so code can be tested, and PSR-7 is the standard shape for that. Treat every value in them as attacker-controlled text: there is no schema and no type.

A bare $name works; anything more complex needs braces, as in "{$user['name']}" or "{$order->total}". The concatenation operator is ., not + — using + on two strings is a TypeError in PHP 8, which is a small mercy after JavaScript's "1" + 1. And note the trailing \n: it only works in double quotes, because single-quoted strings do not process escapes either.

printf writes, sprintf returns the string, and vsprintf takes the arguments as an array. The specifiers are C's: %s, %d, %.2f, %05d, and %'*10s for padding with a chosen character. number_format is the money-shaped one, with thousands separators and a fixed number of decimals — the closest thing to toLocaleString, without the locale.

That de-indenting rule is the one thing a template literal cannot do — a JavaScript multi-line string carries whatever leading spaces the source had, which is why dedent libraries exist. Use <<<'TEXT' with quotes around the marker for the nowdoc form, which is the single-quoted variant: no interpolation, no escapes.

Because there is no declaration keyword, a typo creates a new variable rather than an error; PHP 8 at least emits a warning when you read one that was never set. The scoping is the bigger surprise: PHP has no block scope and no closure over enclosing locals. A variable set inside an if is visible after it, and a function cannot see the surrounding function's variables unless you pass them in — which is what use in the closures section is for. const at file level declares a genuine constant, and it takes no dollar sign.

That makes them closer to a runtime assertion than to a type system, and it means they are worth adding even to code nobody type-checks — a wrong argument fails at the boundary rather than three frames deeper. declare(strict_types=1) at the top of every file is the setting you want: without it PHP coerces "21" to 21 and the call succeeds silently. Static analysers (PHPStan, Psalm) read the same declarations plus docblock generics and give you the compile-time half.

?? works the same way in both languages — it falls back only on null (and, in PHP, on a missing key), never on 0 or "", which is what makes it better than || and or. ?-> is the nullsafe operator, PHP's ?.: $order?->customer?->name stops at the first null instead of raising. empty() is the trap to avoid — it is true for 0, "0", "" and [] as well as null.

7 / 2 gives 3.5 in both, because PHP promotes to float rather than truncating; intdiv is the integer division, and % is integer-only (use fmod for floats). The overflow behaviour differs interestingly: past PHP_INT_MAX an integer silently becomes a float and starts losing precision, where JavaScript was imprecise above MAX_SAFE_INTEGER all along. Both print 0.30000000000000004 for the classic, because both are IEEE 754 underneath — but only because this example uses var_export: a plain echo 0.1 + 0.2 prints 0.3, since echo rounds to precision (14 digits by default) while var_export and json_encode use serialize_precision and show the truth.

The tables differ in the details, so do not port the trivia across. 0 == "" is true in JavaScript and false in PHP — it was true in PHP too before 8.0, and "abc" == 0 is false now as well, because PHP 8 compares a number to a non-numeric string as strings. null == 0 goes the other way: false in JavaScript, where null only equals undefined, and true in PHP, where null converts to 0. That was the single most-mocked wart in the language and it is gone. === compares type and value, and for objects it means the same instance, exactly as in JavaScript.

PHP arrays compare by contents: === is true when the same key/value pairs appear in the same order with the same types, and == ignores the order. JavaScript has no structural comparison at all for arrays or objects, which is why JSON.stringify gets abused for it. For objects PHP keeps the JavaScript rule — == is same class with equal properties, === is the same instance.

The string "0" is falsy in PHP and truthy in JavaScript — a real source of bugs when a form field or a database column arrives as text. And an empty array is falsy in PHP where an empty array is truthy in JavaScript, which is the one that catches JavaScript developers most often (if ($rows) is an idiomatic emptiness test here). Objects are always truthy in both.

That is why count() works on both and why every array function takes both. The cost is that "is this a list or a dictionary?" has no type-level answer — array_is_list() (PHP 8.1) is the run-time check, and it matters because json_encode emits […] for a list and {…} for anything else, so deleting one element can change the shape of your API response.

So a function that appends to an array parameter changes nothing the caller can see, unless the parameter is declared &$items to pass by reference. The copy is lazy underneath — PHP copies on write, so the cost is only paid if you modify it — but the semantics are a full copy. Objects go the other way and behave exactly like JavaScript: $b = $a on an object gives you two names for one instance, and clone is how you get a copy (a shallow one).

Watch the argument order, which is genuinely inconsistent: array_map(callback, array) puts the callback first, while array_filter(array, callback) and array_reduce(array, callback, initial) put the array first. And array_filter preserves keys, so filtering a list can leave you with keys 1, 3, 5 and a json_encode that suddenly emits an object — wrap it in array_values() when you want a list back. This is the row where PHP is plainly worse than JavaScript, and knowing it in advance saves the surprise.

There is no rest element in a destructuring assignment: write [$first] = $numbers; and then array_slice($numbers, 1). Everything else is there — [$a, $b] = $pair;, keyed destructuring as ['name' => $name] = $person;, nested patterns, and foreach ($pairs as [$left, $right]). Spread works in array literals ([...$first, ...$second], with string keys allowed since 8.1) and in calls (sum(...$numbers)), and ... in a parameter list is the variadic form.

Leaving $strict off is how in_array("abc", [0]) used to return true — PHP 8 fixed that particular case, but pass true anyway and mean it. array_search returns the key, or false when nothing matched, so compare with !== false rather than truthiness, since key 0 is falsy. There is no find: filter and take the first, or write the foreach. And note in: JavaScript's in tests keys, and PHP's in_array tests values — the false friend on this row.

The comparator returns a negative number, zero or a positive one in both, and PHP's <=> spaceship operator produces exactly that for any two comparable values. The family is large and the names encode the axis: sort discards keys, asort keeps them, ksort sorts by key, usort/uasort/uksort take your comparator. One thing PHP gets right that JavaScript does not: sort([10, 9, 100]) compares numbers as numbers, where JavaScript's default comparator stringifies and gives you 10, 100, 9.

The argument order is the famous part. str_replace($search, $replace, $subject) puts the subject last, while strpos($haystack, $needle) puts it first — the inconsistency is historical (the string functions borrowed C's order, the array functions did not) and it is not going away. The modern additions are consistent and worth preferring: str_contains, str_starts_with and str_ends_with (all PHP 8.0) take the haystack first and return real booleans, replacing the old strpos(...) !== false dance.

explode refuses an empty separator — it throws a ValueError rather than splitting into characters, which is what str_split is for (or mb_str_split when the text is not ASCII). implode accepts its two arguments in either order for historical reasons, but write implode($glue, $pieces). join exists as an alias of implode, which is a small kindness to anyone arriving from JavaScript.

JavaScript strings are UTF-16 code units, which has its own emoji-shaped problems, but at least "naïve".length is 5. In PHP strlen says 6, and substr($word, 0, 3) can cut a character in half and produce invalid UTF-8. The rule is simple: for user-facing text, use the mb_* family (mb_strlen, mb_substr, mb_strtoupper) and set mb_internal_encoding('UTF-8'). Byte functions are correct only when you genuinely mean bytes. mb_* lives in the mbstring extension, which is not compiled into every PHP build — extension_loaded('mbstring') is worth checking before you rely on it.

So /order (\d+)/i becomes the string '/order (\d+)/i', single-quoted so the backslashes survive. Matches come back through a by-reference third parameter rather than a return value, and the return value is the count (or false on a malformed pattern). Replacement is global by default, the opposite of JavaScript, where g is opt-in. The engine is PCRE, so the syntax itself is the one you know, with a few extras JavaScript lacks such as possessive quantifiers.

Since arrays are values, foreach iterates over a copy and modifying the array inside the loop is safe — the loop sees the array as it was. Writing foreach ($items as &$item) gives you a reference so you can modify each element in place, and it carries a famous trap: $item is still a reference to the last element after the loop, so a second foreach reusing that name corrupts the array. unset($item) after the loop, or avoid the ampersand.

It is an expression, so it returns a value and needs no return per branch; there is no fall-through, so no break and no accidental cascade; and it compares with === rather than ==, so match("1") does not hit the 1 arm. An unmatched value with no default throws UnhandledMatchError instead of silently doing nothing. A condition-shaped form exists too: match(true) { $age >= 18 => ..., default => ... }, which is the idiomatic replacement for an if/else ladder.

?: — the "Elvis" operator — is PHP's ||: it falls back on anything falsy, so an empty string or 0 triggers it. ?? falls back only on null or a missing key, exactly as in JavaScript, and unlike ?: it does not warn about an undefined index. Reach for ?? by default and ?: only when you genuinely mean "or anything empty". ??= exists too.

By default use ($count) captures the value at the moment the closure is created, so the counter would return 1 forever; use (&$count) captures the variable by reference, which is what a JavaScript closure always does. Arrow functions (PHP 7.4's fn() => ...) skip the ceremony — they capture by value automatically — but they are limited to a single expression, so a multi-statement closure still needs the long form.

The differences are worth knowing. A PHP arrow function is one expression only — no braces, no statements — and it captures by value, so assigning to a captured variable inside it changes nothing outside. And it does not exist to fix this, because PHP's $this was never re-bound by calling convention; a closure inside a method sees $this automatically. The whole class of JavaScript bugs that bind, self = this and arrow functions were invented to solve simply does not arise.

Any parameter can be passed by name, in any order after the positional ones, and the name is part of the public signature — renaming a parameter is a breaking change, which is the one new obligation this brings. Defaults work as you would expect and must follow the required parameters. Variadics use ...$rest in the signature, and ...$array at a call site spreads, including spreading a keyed array into named arguments.

A plain string names a global function ('strtoupper'), an array names a method ([$object, 'method'] or [Klass::class, 'staticMethod']), and PHP 8.1's first-class callable syntax makes a real closure out of any of them: strtoupper(...), $object->method(...). Prefer that last form — it is checked when it is written, where a string typo fails only when called. The callable type declaration accepts all of them.

Three notes for a JavaScript reader. $this-> is the arrow, not a dot, and $this is mandatory — a bare $balance inside a method is a local variable, not the property. readonly (PHP 8.1) makes a property assignable exactly once, from inside the class, which is stronger than #private plus a getter and much shorter. And visibility is real: private is enforced by the runtime, as JavaScript's # fields now are, while the older PHP convention of a leading underscore never was.

Inside the class, self:: refers to the class the code was written in and static:: to the class actually being called (late static binding — the difference matters the moment you subclass). parent::method() is super.method(). Note that a static property keeps its $ after the colons, while a const does not — a small inconsistency you will mistype at least once.

A trait is compiler-level copy-and-paste — its methods and properties are inserted into the using class at compile time, so there is no extra object in the chain and no runtime lookup. Conflicts between two traits are an error you must resolve explicitly with insteadof, which is the part Object.assign silently gets wrong. Interfaces may declare constants and, unlike traits, take part in type declarations — so type your parameters against the interface and get the behaviour from the trait.

Both columns print the same two lines and got there by opposite means: JavaScript added a real method to every Duck ever created, while PHP made a closure that Duck knows nothing about, and the property landed on a stdClass rather than on the duck. Assigning to an undeclared property on a normal class is deprecated in 8.2 and an Error in 9; add #[\AllowDynamicProperties] above the class if you truly need the old behaviour, or use stdClass, which is the anonymous-object type that json_decode returns and where dynamic properties remain normal. The magic methods __get, __set and __call are the supported way to fake a dynamic surface — that is how Laravel's Eloquent models work. Nothing patches a class from outside; dependency injection is the escape hatch instead.

That means a parameter typed Status cannot receive a typo, and match ($this) over every case needs no default. A backed enum (the : string above) carries a scalar for the database or JSON, with Status::from('active') to convert in and ->value to convert out; tryFrom returns null instead of throwing. Enums may hold methods, implement interfaces and have constants — but not properties, since each case is a singleton.

So catch (JsonException $error) catches only that, and several catch blocks may follow one try — the JavaScript idiom of one catch with an if (error instanceof ...) ladder is unnecessary. Catch \Throwable for genuinely everything, or \Exception for the ordinary half. Note the named argument flags:, and note that json_decode without JSON_THROW_ON_ERROR returns null on bad input rather than throwing, which is the older PHP style you will meet everywhere.

Both implement Throwable, which is what a truly catch-everything block names. Extend RuntimeException or LogicException rather than Exception directly — the SPL hierarchy is shallow and conventional, and the split (a bug in the program versus a bad input at run time) is a useful one. The message is read with getMessage(), not a property, and getPrevious() carries the chained cause, the equivalent of the cause option.

Reading a missing array key is a warning (it was a notice before PHP 8), and the value you get is null. JavaScript is quieter still — undefined with no message at all — so the shape of the bug is familiar even if the noise is not. The second line shows where the two diverge dangerously: adding one to the missing value gives NaN in JavaScript, which poisons every later calculation and is at least visible, but 1 in PHP, because null becomes 0 and the wrong answer looks exactly like a right one. Two habits: use ?? to read anything that might be absent, and configure the application to turn warnings into exceptions with a set_error_handler that throws ErrorException, which most frameworks do for you. The @ operator above suppresses diagnostics for one expression and is almost always the wrong tool.

This removes the entire "function colouring" problem: any function may call any other, and a library that does I/O needs no async variant. The whole shape of a PHP codebase follows from it — no callbacks, no .then chains, no unhandled rejections, and a stack trace that reaches all the way back to the entry point. What you lose is the ability to do two slow things at once inside one request, which the next two rows are about.

When that is too slow there are three real answers, in order of how often they are the right one. curl_multi_exec runs many HTTP requests in parallel inside one process and is what Guzzle's concurrency uses. A queue (Laravel Horizon, Symfony Messenger) pushes the work to separate worker processes and is the standard answer for anything slow. And an event-loop runtime — ReactPHP or Amp, both built on Fibers — gives you the Node model at the cost of running your app differently. Most PHP applications reach for the queue.

The crucial difference from async/await is that the suspension is invisible to the caller — an ordinary function deep inside a fiber may suspend, so a library needs no async version of itself. That is why Fibers were added: to let ReactPHP and Amp drive ordinary-looking code. You will almost certainly never write new Fiber yourself; it is plumbing for frameworks, and a normal PHP application never suspends at all.

The syntax has no * — the presence of yield is what makes it a generator, as in Python. yield $key => $value produces keys, yield from delegates to another generator, and a generator can receive values back through $generator->send(), exactly like JavaScript's. Spreading needs iterator_to_array rather than [...], and generators are the standard way to stream a large database result or a big file without holding it all in memory.

<?= $value ?> is shorthand for <?php echo $value; ?>. The alternative syntax — foreach (...): … endforeach; — exists precisely for templates, because a closing brace lost among HTML is unreadable. 🚨 Nothing is escaped for you. There is no JSX-style automatic escaping and no textContent: htmlspecialchars() on every interpolated value is the difference between a template and a cross-site-scripting hole. Template engines (Blade, Twig) escape by default, which is much of why they exist.

header() must be called before any output — including a stray blank line after a ?> in an included file, which is the classic "headers already sent" error. json_encode returns false on failure unless you pass JSON_THROW_ON_ERROR, and JSON_PRETTY_PRINT and JSON_UNESCAPED_SLASHES are the flags you will want. Remember the list-versus-map rule: an array with non-sequential keys encodes as a JSON object, so array_values() before encoding anything that must stay an array.

So there is no module.exports, no named exports, and no per-module scope for functions or classes; variables at the top level of the required file land in the requiring scope, which is why includes usually declare only functions and classes. require fails hard when the file is missing, include only warns, and the _once variants are what you want for definitions. In practice modern code never writes these at all: Composer's autoloader maps a class name to a file and requires it the first time it is used.

That is the opposite of an ES import: use App\Http\Client; only says "when I write Client, I mean that one", and the file is found later by the autoloader. The separator is a backslash, which is why example code is full of them and why they must be escaped in double-quoted strings. A leading backslash means the global namespace — \strlen(), \Throwable — which is why library code is dotted with them. PSR-4 is the convention that ties App\Http\Client to src/Http/Client.php.

The big practical difference is one line of ceremony: PHP has no module loader, so every entry point starts with require __DIR__ . '/vendor/autoload.php';, after which every installed class is available by name with no further imports. Trees are far smaller — a Laravel install pulls tens of packages where a React app pulls thousands — because PHP's standard library covers strings, arrays, dates, hashing, HTTP and databases without help. composer.lock is committed, composer install honours it, and composer update is the one that changes it.

So $parsed->name works by default and $parsed['name'] works with associative: true — and mixing the two up is the most common PHP JSON bug. Nested JSON objects become nested arrays either way. Pass JSON_THROW_ON_ERROR in the flags so malformed input throws a JsonException instead of quietly returning null, which is indistinguishable from a literal null in the document.

Always reach for DateTimeImmutable rather than the mutable DateTime — the mutable one has exactly the aliasing bug JavaScript Date has, where handing it to a function lets that function change your value. format() takes the single-letter codes (Y-m-d H:i:s), diff() returns a DateInterval, and modify("+1 month") accepts the same relative English that strtotime does. This is where Temporal is trying to take JavaScript.

file_get_contents and file_put_contents are the read-it-all and write-it-all pair, and file() reads straight into an array of lines. Both accept URLs as well as paths when allow_url_fopen is on, which is how a great deal of quick-and-dirty PHP fetches HTTP — convenient, and a security consideration when the path comes from a user. For anything large, fopen/fgets/fclose give you the streaming form, and SplFileObject wraps it as an iterator.

password_hash picks a modern algorithm (bcrypt today, argon2 available), generates the salt, and encodes the algorithm and cost into the stored string; password_verify reads them back and compares in constant time. There is no salt to manage and no library to choose, which removes the most common way an application gets authentication wrong. PASSWORD_DEFAULT deliberately changes between PHP versions — that is what password_needs_rehash is for.