📝 Article
PHP: The Language Behind the Web Page
By Dave Milliken
Visit a website and you normally just see the finished result: a page loads, and there's text, images, buttons, menus, forms. Maybe you log in. Maybe you add something to a basket, or update your account. Behind a huge share of websites, though, considerably more is happening than the browser ever shows you. A modern site typically needs to receive information from a user, check a database, save something, retrieve something else, decide exactly what that user's actually allowed to see, and build a page dynamically to reflect all of it. One language traditionally built for exactly this kind of work is PHP.
An interesting name, with a joke buried inside it
PHP originally stood for Personal Home Page, back when it started life as a small collection of tools for building, well, personal home pages. As the language grew up, the name changed with it, and today PHP officially stands for PHP: Hypertext Preprocessor, which means the word PHP appears inside its own definition. That's a recursive acronym, PHP genuinely equals "PHP: Hypertext Preprocessor," and programmers occasionally find this kind of self-referential joke rather too delightful to resist.
What PHP actually is
PHP is a server-side programming language, and that distinction genuinely matters. HTML, CSS, and JavaScript are normally sent straight to your browser, which does the actual work of interpreting them. PHP, by contrast, generally runs on the web server itself: your browser sends a request, the server runs the relevant PHP, PHP produces a response, and only that finished response ever travels back to your browser. You never receive the PHP source code directly, only whatever output it decided to generate.
The front end, briefly
HTML provides a page's structure and content, headings, paragraphs, forms, buttons, tables. CSS controls how all of that actually looks, colours, fonts, spacing, layout. JavaScript adds behaviour inside the browser itself, responding to clicks, showing menus, validating forms, updating parts of a page without a full reload. Together, these three make up most of what you actually see and click on.
But websites need somewhere to remember things
A purely informational site might genuinely need nothing beyond HTML and CSS. But most genuinely useful websites need to remember things, user accounts, passwords, products, orders, baskets, bookings, messages, courses, students, invoices, and considerably more, and that information has to live somewhere. Very often, that somewhere is a database.
Databases, briefly
A database gives you structured storage, a table holding user ID, name, email, password hash, and account status, another holding product ID, name, price, and stock level. The page itself needs a genuine way to retrieve and update that stored information, and that's exactly where several technologies start working together.
SQL, briefly
Relational databases are generally queried using SQL, Structured Query Language, which lets you ask a database questions and make changes directly, retrieve a user, find a product, create an order, update an address, delete or archive a record. The database understands SQL perfectly well. The HTML page itself, though, doesn't normally connect to a database and start firing off SQL commands on its own. Something needs to coordinate that whole process, and PHP is very often exactly that something.
PHP as the coordinating middle layer
Picture someone visiting a login page and entering an email and a password. The browser sends that information to the web server, PHP receives it, and PHP can then validate the input, query the database, confirm the user genuinely exists, verify the password, check the account's actually active, create a login session, and decide what page should appear next. PHP sits right in the middle, bridging what the user actually sees and the data stored behind the scenes.
A simple example
PHP might contain something conceptually like $userName = "Anne"; echo "Welcome " . $userName;, and the resulting page simply displays "Welcome Anne." The browser has no idea, and no need to know, how PHP actually produced that text. It just receives the finished output.
PHP can live directly inside HTML
Part of what made PHP so widely adopted is that PHP code can sit embedded right inside an HTML page, a heading, then a block of PHP that echoes "Hello, Dave," then a closing paragraph. That PHP block gets processed entirely on the server, and the browser ultimately just receives the finished, plain HTML with "Hello, Dave" sitting where the PHP used to be. By the time the page reaches the browser, the PHP has already finished running.
The browser doesn't normally see the PHP at all
This is a genuinely important distinction between PHP and JavaScript. JavaScript commonly runs directly inside the browser, meaning the browser receives the actual JavaScript code itself. PHP normally runs on the server instead, which executes it and sends back only the result. JavaScript commonly runs client-side. PHP commonly runs server-side. That division isn't absolute in every corner of modern web development, but it's a genuinely useful starting point for understanding where each one actually operates.
Connecting to a database
PHP can connect to databases like MySQL, MariaDB, PostgreSQL, SQLite, and SQL Server, and once connected, it can send SQL queries and work directly with whatever comes back. A user opens their account, PHP asks the database which account belongs to them, the database hands back the relevant record, and PHP uses that record to actually build the page.
PDO
Modern PHP includes a standard database interface called PDO, PHP Data Objects, giving PHP a consistent way of talking to different database systems without needing entirely separate code for each one, connect to the database, prepare a query, supply the values, run it, read the result. The exact syntax matters once you're writing real applications, but the underlying idea is simple: PDO helps PHP communicate with a database safely and consistently.
Prepared statements
When PHP receives information from a user, that information should never simply get glued directly into an SQL query string. Doing that can create genuinely serious security holes. Modern PHP applications instead lean on prepared statements: prepare the structure of the SQL query first, keep the user's actual data entirely separate, and only supply the values afterwards. This helps guard against SQL injection specifically. The lesson here was never about memorising the exact syntax, it's that user input needs handling with real care throughout a web application, not treated as trustworthy text to be pasted straight into a command.
Logging in, as a worked example
A login form is a genuinely good illustration of how all these pieces fit together. The user sees an HTML form, some CSS styling, maybe a little JavaScript validation. They type in an email and password, the browser sends that to PHP, PHP checks whether the input's actually valid, queries the database via SQL, gets back the matching user record, verifies the password, and, if everything checks out, creates a session. The user is now considered logged in, having triggered what looks to them like one simple, single action, while several distinct technologies quietly did their separate jobs underneath it.
Sessions
HTTP, the underlying protocol the web runs on, is naturally quite stateless, meaning each individual request can look entirely independent of the last. PHP uses sessions to hold onto information across multiple requests, a user ID, login status, a role, some temporary basket contents, letting the application genuinely remember "this is still Dave, he's already logged in, and he's an administrator," rather than treating every single click as a stranger showing up fresh.
Forms
PHP is used constantly to process forms, contact forms, registration forms, login forms, booking forms, newsletter sign-ups. The user fills one in, the browser sends the data across, and PHP takes it from there, validating it, saving it, emailing it, rejecting it, showing an error, or redirecting the user onward, all more behind-the-scenes work most visitors never think twice about.
GET and POST
You'll commonly run into two ways of sending information to a web application, GET and POST. GET tends to be used for requesting information, searching for laptops, say. POST tends to be used for submitting or changing something, creating an account, saving a form, logging in. That's a simplified way of putting it, but a genuinely useful starting point, and PHP can receive and process either kind.
Dynamic pages
One of the real advantages of server-side programming is that pages can be generated dynamically rather than written out by hand one at a time. An online shop doesn't need someone manually writing a fresh HTML page every single time a product changes, PHP queries the database, the database returns whatever products currently exist, and PHP builds the appropriate page on the fly. Tomorrow, the database might hold entirely different products, and the exact same PHP code will happily produce entirely different output. That's what actually makes a website dynamic rather than static.
PHP does considerably more than just build HTML pages
PHP can also produce JSON, XML, files, images, API responses, downloads, and redirects, and it can send emails, process uploads, generate reports, read and write files, talk to other APIs, manage sessions, and run standalone command-line scripts. PHP is genuinely a general-purpose programming language that simply became particularly closely associated with web development along the way.
WordPress, and why PHP stays so widely encountered
One major reason PHP remains so common today is WordPress, which is written primarily in PHP. As of the most recent measurements available, WordPress alone powers somewhere around 40% of all websites on the internet, a genuinely enormous share, considerably ahead of any single competitor. That means a huge number of websites depend on PHP under the hood, even when whoever's actually managing the site never writes a single line of PHP themselves. Plenty of other major systems and applications have been built on PHP too, but WordPress alone accounts for a genuinely staggering slice of PHP's continued reach across the web.
From a simple script to a full application
PHP can be genuinely trivial, a two-line script echoing "Hello World" is perfectly valid PHP. But it can also power large applications involving authentication, databases, APIs, payments, file storage, user roles, reporting, business logic, and full administration systems. The language itself scales comfortably from a tiny script up to a genuinely large system, though the quality of the underlying architecture matters considerably more as that system grows.
What a framework actually is
As applications grow larger, developers keep bumping into the exact same recurring problems, routing requests, connecting to databases, validating forms, handling users, managing sessions, sending emails, building templates, handling errors. Rather than rebuilding all of that from scratch on every single project, developers reach for frameworks instead, a structure and toolkit built specifically for constructing applications.
Laravel
One of the best-known PHP frameworks is Laravel, offering ready-made tools for routing, database access, authentication, validation, templates, email, background queues, testing, and various security features. You still write the actual application yourself, Laravel just supplies a considerable amount of the underlying structure so you're not rebuilding it from nothing.
Other PHP frameworks
Symfony, CodeIgniter, and CakePHP are other well-known PHP frameworks, each taking a somewhat different approach, some considerably larger and more comprehensive, others deliberately lighter, some aimed at particular kinds of development. The underlying idea stays consistent throughout: don't reinvent common infrastructure on every single new project.
Flask, for contrast
Flask is also a genuine web framework, but it belongs entirely to Python, not PHP, a useful reminder that a framework and a programming language are two separate ideas sitting on top of each other. Python has frameworks like Flask and Django. PHP has frameworks like Laravel, Symfony, and CodeIgniter. The framework simply sits on top of whichever language it's built for, providing extra structure and tooling around it.
Why bother with a framework at all
Frameworks tend to offer consistency, reusable components, a standard project structure, built-in security features, database tooling, validation, routing, and testing support, generally meaning faster development overall. They also make it considerably easier for another developer already familiar with that framework to understand your project quickly, since you're following shared, established conventions rather than inventing your own approach to everything from scratch.
Frameworks have real drawbacks too
A framework isn't automatically the better choice. It brings extra complexity, dependencies, rules, conventions, and a genuine learning curve along with it. For a genuinely tiny application, reaching for a large framework can be considerably more overhead than the problem actually warrants, and plain, simple PHP is sometimes entirely adequate on its own. The right tool depends entirely on the actual problem in front of you.
PHP as the glue holding a traditional web application together
One useful way to hold all of this together: HTML creates the structure, CSS controls the appearance, JavaScript provides browser-side interaction, SQL communicates with the database, the database itself stores the information, and PHP helps connect all of those separate pieces together on the server. A user clicks Login, the browser sends the form, PHP receives it, asks the database via SQL, gets the user record back, verifies the credentials, creates a session, and sends back the resulting page for the browser to display. That's the role PHP very often plays, quietly, in the middle of it all.
Server-side code carries the real authority
A browser should never be trusted with every important decision on its own. Whether a user's genuinely an administrator, whether a payment's actually valid, whether someone's allowed to view a particular record, whether a password's genuinely been verified, these decisions belong on the server, enforced there directly. JavaScript can make the experience feel smoother and more responsive. Server-side code like PHP provides the actual, authoritative checks, precisely because browser-side code can always be altered or bypassed by whoever's sitting at the keyboard.
PHP and security
Because PHP so often sits directly between users and sensitive data, security genuinely matters throughout. PHP applications need to think carefully about input validation, prepared SQL statements, password hashing, sessions, permissions, file uploads, output escaping, authentication, and error handling. The point here was never to teach every one of those subjects in full, it's that PHP frequently operates at a genuinely security-sensitive part of the system, receiving information straight from users and working directly with real data, which is exactly why writing it carefully actually matters.
The important part
PHP is a server-side programming language strongly associated with web development, officially standing for PHP: Hypertext Preprocessor, and it very often sits quietly behind the visible parts of a website. A typical web application weaves together HTML for structure, CSS for appearance, JavaScript for browser-side behaviour, PHP for server-side processing and application logic, SQL for talking to a relational database, and the database itself for persistent storage. A user might just see a Login button. Behind it might sit HTML, JavaScript, PHP, SQL, a full database, password verification, sessions, and permission checks, all working together. What looks simple sitting on the screen can involve several distinct layers cooperating underneath, and PHP is very often one of the technologies making sure those layers actually talk to each other properly.
Further reading
PHP: The Right Way is a widely used, freely available online guide covering modern PHP practices, dependency management, databases, security, and testing tools.
Modern PHP, by Josh Lockhart, offers a genuinely useful introduction to contemporary PHP development and the broader ecosystem that's grown up around it.
Laravel's official documentation is an excellent, practical way to see how PHP actually gets used inside a modern web framework, for anyone curious to look further.
The genuinely important thing to understand about PHP was never memorising its syntax. It's understanding exactly where PHP sits in the system: the browser displays the application, the database stores the information, SQL talks to that database, and PHP helps the whole conversation actually happen.
An interesting name, with a joke buried inside it
PHP originally stood for Personal Home Page, back when it started life as a small collection of tools for building, well, personal home pages. As the language grew up, the name changed with it, and today PHP officially stands for PHP: Hypertext Preprocessor, which means the word PHP appears inside its own definition. That's a recursive acronym, PHP genuinely equals "PHP: Hypertext Preprocessor," and programmers occasionally find this kind of self-referential joke rather too delightful to resist.
What PHP actually is
PHP is a server-side programming language, and that distinction genuinely matters. HTML, CSS, and JavaScript are normally sent straight to your browser, which does the actual work of interpreting them. PHP, by contrast, generally runs on the web server itself: your browser sends a request, the server runs the relevant PHP, PHP produces a response, and only that finished response ever travels back to your browser. You never receive the PHP source code directly, only whatever output it decided to generate.
The front end, briefly
HTML provides a page's structure and content, headings, paragraphs, forms, buttons, tables. CSS controls how all of that actually looks, colours, fonts, spacing, layout. JavaScript adds behaviour inside the browser itself, responding to clicks, showing menus, validating forms, updating parts of a page without a full reload. Together, these three make up most of what you actually see and click on.
But websites need somewhere to remember things
A purely informational site might genuinely need nothing beyond HTML and CSS. But most genuinely useful websites need to remember things, user accounts, passwords, products, orders, baskets, bookings, messages, courses, students, invoices, and considerably more, and that information has to live somewhere. Very often, that somewhere is a database.
Databases, briefly
A database gives you structured storage, a table holding user ID, name, email, password hash, and account status, another holding product ID, name, price, and stock level. The page itself needs a genuine way to retrieve and update that stored information, and that's exactly where several technologies start working together.
SQL, briefly
Relational databases are generally queried using SQL, Structured Query Language, which lets you ask a database questions and make changes directly, retrieve a user, find a product, create an order, update an address, delete or archive a record. The database understands SQL perfectly well. The HTML page itself, though, doesn't normally connect to a database and start firing off SQL commands on its own. Something needs to coordinate that whole process, and PHP is very often exactly that something.
PHP as the coordinating middle layer
Picture someone visiting a login page and entering an email and a password. The browser sends that information to the web server, PHP receives it, and PHP can then validate the input, query the database, confirm the user genuinely exists, verify the password, check the account's actually active, create a login session, and decide what page should appear next. PHP sits right in the middle, bridging what the user actually sees and the data stored behind the scenes.
A simple example
PHP might contain something conceptually like $userName = "Anne"; echo "Welcome " . $userName;, and the resulting page simply displays "Welcome Anne." The browser has no idea, and no need to know, how PHP actually produced that text. It just receives the finished output.
PHP can live directly inside HTML
Part of what made PHP so widely adopted is that PHP code can sit embedded right inside an HTML page, a heading, then a block of PHP that echoes "Hello, Dave," then a closing paragraph. That PHP block gets processed entirely on the server, and the browser ultimately just receives the finished, plain HTML with "Hello, Dave" sitting where the PHP used to be. By the time the page reaches the browser, the PHP has already finished running.
The browser doesn't normally see the PHP at all
This is a genuinely important distinction between PHP and JavaScript. JavaScript commonly runs directly inside the browser, meaning the browser receives the actual JavaScript code itself. PHP normally runs on the server instead, which executes it and sends back only the result. JavaScript commonly runs client-side. PHP commonly runs server-side. That division isn't absolute in every corner of modern web development, but it's a genuinely useful starting point for understanding where each one actually operates.
Connecting to a database
PHP can connect to databases like MySQL, MariaDB, PostgreSQL, SQLite, and SQL Server, and once connected, it can send SQL queries and work directly with whatever comes back. A user opens their account, PHP asks the database which account belongs to them, the database hands back the relevant record, and PHP uses that record to actually build the page.
PDO
Modern PHP includes a standard database interface called PDO, PHP Data Objects, giving PHP a consistent way of talking to different database systems without needing entirely separate code for each one, connect to the database, prepare a query, supply the values, run it, read the result. The exact syntax matters once you're writing real applications, but the underlying idea is simple: PDO helps PHP communicate with a database safely and consistently.
Prepared statements
When PHP receives information from a user, that information should never simply get glued directly into an SQL query string. Doing that can create genuinely serious security holes. Modern PHP applications instead lean on prepared statements: prepare the structure of the SQL query first, keep the user's actual data entirely separate, and only supply the values afterwards. This helps guard against SQL injection specifically. The lesson here was never about memorising the exact syntax, it's that user input needs handling with real care throughout a web application, not treated as trustworthy text to be pasted straight into a command.
Logging in, as a worked example
A login form is a genuinely good illustration of how all these pieces fit together. The user sees an HTML form, some CSS styling, maybe a little JavaScript validation. They type in an email and password, the browser sends that to PHP, PHP checks whether the input's actually valid, queries the database via SQL, gets back the matching user record, verifies the password, and, if everything checks out, creates a session. The user is now considered logged in, having triggered what looks to them like one simple, single action, while several distinct technologies quietly did their separate jobs underneath it.
Sessions
HTTP, the underlying protocol the web runs on, is naturally quite stateless, meaning each individual request can look entirely independent of the last. PHP uses sessions to hold onto information across multiple requests, a user ID, login status, a role, some temporary basket contents, letting the application genuinely remember "this is still Dave, he's already logged in, and he's an administrator," rather than treating every single click as a stranger showing up fresh.
Forms
PHP is used constantly to process forms, contact forms, registration forms, login forms, booking forms, newsletter sign-ups. The user fills one in, the browser sends the data across, and PHP takes it from there, validating it, saving it, emailing it, rejecting it, showing an error, or redirecting the user onward, all more behind-the-scenes work most visitors never think twice about.
GET and POST
You'll commonly run into two ways of sending information to a web application, GET and POST. GET tends to be used for requesting information, searching for laptops, say. POST tends to be used for submitting or changing something, creating an account, saving a form, logging in. That's a simplified way of putting it, but a genuinely useful starting point, and PHP can receive and process either kind.
Dynamic pages
One of the real advantages of server-side programming is that pages can be generated dynamically rather than written out by hand one at a time. An online shop doesn't need someone manually writing a fresh HTML page every single time a product changes, PHP queries the database, the database returns whatever products currently exist, and PHP builds the appropriate page on the fly. Tomorrow, the database might hold entirely different products, and the exact same PHP code will happily produce entirely different output. That's what actually makes a website dynamic rather than static.
PHP does considerably more than just build HTML pages
PHP can also produce JSON, XML, files, images, API responses, downloads, and redirects, and it can send emails, process uploads, generate reports, read and write files, talk to other APIs, manage sessions, and run standalone command-line scripts. PHP is genuinely a general-purpose programming language that simply became particularly closely associated with web development along the way.
WordPress, and why PHP stays so widely encountered
One major reason PHP remains so common today is WordPress, which is written primarily in PHP. As of the most recent measurements available, WordPress alone powers somewhere around 40% of all websites on the internet, a genuinely enormous share, considerably ahead of any single competitor. That means a huge number of websites depend on PHP under the hood, even when whoever's actually managing the site never writes a single line of PHP themselves. Plenty of other major systems and applications have been built on PHP too, but WordPress alone accounts for a genuinely staggering slice of PHP's continued reach across the web.
From a simple script to a full application
PHP can be genuinely trivial, a two-line script echoing "Hello World" is perfectly valid PHP. But it can also power large applications involving authentication, databases, APIs, payments, file storage, user roles, reporting, business logic, and full administration systems. The language itself scales comfortably from a tiny script up to a genuinely large system, though the quality of the underlying architecture matters considerably more as that system grows.
What a framework actually is
As applications grow larger, developers keep bumping into the exact same recurring problems, routing requests, connecting to databases, validating forms, handling users, managing sessions, sending emails, building templates, handling errors. Rather than rebuilding all of that from scratch on every single project, developers reach for frameworks instead, a structure and toolkit built specifically for constructing applications.
Laravel
One of the best-known PHP frameworks is Laravel, offering ready-made tools for routing, database access, authentication, validation, templates, email, background queues, testing, and various security features. You still write the actual application yourself, Laravel just supplies a considerable amount of the underlying structure so you're not rebuilding it from nothing.
Other PHP frameworks
Symfony, CodeIgniter, and CakePHP are other well-known PHP frameworks, each taking a somewhat different approach, some considerably larger and more comprehensive, others deliberately lighter, some aimed at particular kinds of development. The underlying idea stays consistent throughout: don't reinvent common infrastructure on every single new project.
Flask, for contrast
Flask is also a genuine web framework, but it belongs entirely to Python, not PHP, a useful reminder that a framework and a programming language are two separate ideas sitting on top of each other. Python has frameworks like Flask and Django. PHP has frameworks like Laravel, Symfony, and CodeIgniter. The framework simply sits on top of whichever language it's built for, providing extra structure and tooling around it.
Why bother with a framework at all
Frameworks tend to offer consistency, reusable components, a standard project structure, built-in security features, database tooling, validation, routing, and testing support, generally meaning faster development overall. They also make it considerably easier for another developer already familiar with that framework to understand your project quickly, since you're following shared, established conventions rather than inventing your own approach to everything from scratch.
Frameworks have real drawbacks too
A framework isn't automatically the better choice. It brings extra complexity, dependencies, rules, conventions, and a genuine learning curve along with it. For a genuinely tiny application, reaching for a large framework can be considerably more overhead than the problem actually warrants, and plain, simple PHP is sometimes entirely adequate on its own. The right tool depends entirely on the actual problem in front of you.
PHP as the glue holding a traditional web application together
One useful way to hold all of this together: HTML creates the structure, CSS controls the appearance, JavaScript provides browser-side interaction, SQL communicates with the database, the database itself stores the information, and PHP helps connect all of those separate pieces together on the server. A user clicks Login, the browser sends the form, PHP receives it, asks the database via SQL, gets the user record back, verifies the credentials, creates a session, and sends back the resulting page for the browser to display. That's the role PHP very often plays, quietly, in the middle of it all.
Server-side code carries the real authority
A browser should never be trusted with every important decision on its own. Whether a user's genuinely an administrator, whether a payment's actually valid, whether someone's allowed to view a particular record, whether a password's genuinely been verified, these decisions belong on the server, enforced there directly. JavaScript can make the experience feel smoother and more responsive. Server-side code like PHP provides the actual, authoritative checks, precisely because browser-side code can always be altered or bypassed by whoever's sitting at the keyboard.
PHP and security
Because PHP so often sits directly between users and sensitive data, security genuinely matters throughout. PHP applications need to think carefully about input validation, prepared SQL statements, password hashing, sessions, permissions, file uploads, output escaping, authentication, and error handling. The point here was never to teach every one of those subjects in full, it's that PHP frequently operates at a genuinely security-sensitive part of the system, receiving information straight from users and working directly with real data, which is exactly why writing it carefully actually matters.
The important part
PHP is a server-side programming language strongly associated with web development, officially standing for PHP: Hypertext Preprocessor, and it very often sits quietly behind the visible parts of a website. A typical web application weaves together HTML for structure, CSS for appearance, JavaScript for browser-side behaviour, PHP for server-side processing and application logic, SQL for talking to a relational database, and the database itself for persistent storage. A user might just see a Login button. Behind it might sit HTML, JavaScript, PHP, SQL, a full database, password verification, sessions, and permission checks, all working together. What looks simple sitting on the screen can involve several distinct layers cooperating underneath, and PHP is very often one of the technologies making sure those layers actually talk to each other properly.
Further reading
PHP: The Right Way is a widely used, freely available online guide covering modern PHP practices, dependency management, databases, security, and testing tools.
Modern PHP, by Josh Lockhart, offers a genuinely useful introduction to contemporary PHP development and the broader ecosystem that's grown up around it.
Laravel's official documentation is an excellent, practical way to see how PHP actually gets used inside a modern web framework, for anyone curious to look further.
The genuinely important thing to understand about PHP was never memorising its syntax. It's understanding exactly where PHP sits in the system: the browser displays the application, the database stores the information, SQL talks to that database, and PHP helps the whole conversation actually happen.