๐ญ๐ฌ ๐๐ผ๐บ๐บ๐ผ๐ป ๐ฃ๐๐ฃ ๐๐๐ด๐ ๐ถ๐ป ๐ฅ๐ฒ๐ฎ๐น-๐ง๐ถ๐บ๐ฒ ๐๐ฒ๐๐ฒ๐น๐ผ๐ฝ๐บ๐ฒ๐ป๐
PHP is a forgiving language. This makes it dangerous in production.
Code works on your local machine. Code reviews pass. Then a silent bug hits your live server. It hits real users during a deadline.
These are not textbook bugs. These are real bugs from login systems, e-commerce sites, and client projects.
Here are 10 common bugs and how to fix them.
Variable Scope Problem: Variables outside a function are not available inside it. Broken: $user = "Rahul"; function greet() { echo $user; } Fixed: function greet($user) { echo $user; } greet("Rahul");
Assignment instead of Comparison Problem: Using = instead of === creates an authentication bypass. Broken: if($isLoggedIn = true) { ... } Fixed: if($isLoggedIn === true) { ... }
UTF-8 Text Issues Problem: strlen() counts bytes, not characters. This breaks validation for non-ASCII text. Broken: echo strlen("เคจเคฎเคธเฅเคคเฅ"); // Returns 18 Fixed: echo mb_strlen("เคจเคฎเคธเฅเคคเฅ", 'UTF-8'); // Returns 6
Missing isset() Problem: Accessing $_POST keys before they exist causes errors. Fixed: $name = $_POST['username'] ?? '';
Plain Text Passwords Problem: Storing raw passwords gives attackers full access if your database leaks. Fixed: $hashed = password_hash($password, PASSWORD_BCRYPT);
SQL Injection Problem: Putting user input directly into queries lets users read or delete your data. Fixed: $stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?"); $stmt->execute([$_GET['id']]);
Redirect without exit() Problem: header() sets a redirect but the script keeps running. Fixed: header("Location: login.php"); exit();
Memory Crashes Problem: file_get_contents() loads entire large files into RAM. Fixed: Use fopen() and fgets() to read files line by line.
Session Errors Problem: session_start() fails if you send any output first. Fixed: Call session_start() at the very top of your script.
Silent Database Errors Problem: PDO hides errors by default. You will not know why a query failed. Fixed: Set PDO::ATTR_ERRMODE to PDO::ERRMODE_EXCEPTION.
Summary Table:
โข Variable Scope: Logic Risk โข = vs ===: Critical Risk โข strlen() UTF-8: Medium Risk โข isset() check: Medium Risk โข Plain Passwords: Critical Risk โข SQL Injection: Critical Risk โข Redirect without exit: High Risk โข Large Files: High Risk โข Session Order: Medium Risk โข PDO Error Mode: High Risk
Avoid these three mistakes:
- Unvalidated input
- Unhandled errors
- Wrong assumptions about state
Always validate input. Always handle errors explicitly.
Source: https://dev.to/bikkisingh/10-common-php-bugs-in-real-time-development-with-fixes-1lf7