How to assess · For hiring teams
How to Assess PHP Skills When Hiring
The test formats that actually work for PHP, what a strong answer looks like, sample questions and a scoring rubric you can use as-is.
The short answer
Assess PHP with a task, not a conversation: security and performance review, build a small feature with tests, ai-scored assessment (e.g. cohesyve) or modernisation conversation. Score it against written criteria you fix before you see any submissions, and weight the criteria that the role actually depends on.
- Uses strict types, typed properties, enums and readonly where they help, and can explain what they prevent
- Structures an application with the framework — service container, middleware, jobs — rather than around it
- Writes parameterised queries or uses the ORM correctly, and can spot injection in a review
- Reads the SQL the ORM produces and avoids N+1 with eager loading
Paste a job description; Cohesyve generates a role-specific assessment and rubric. Ten candidates free, no card.
PHP runs a large fraction of the web and carries a reputation from its early years that modern PHP does not deserve. The hiring problem is that both kinds of PHP developer exist: those who write typed, tested, framework-aware code in Laravel or Symfony, and those whose habits were formed before any of that existed. A résumé cannot tell you which one you are talking to. This page covers how to assess PHP as it is written well today: types and modern language features, framework structure, database access, security basics, and testing.
Why PHP is worth testing
PHP applications fail in familiar ways: SQL injection from string-built queries, an N+1 behind an ORM, business logic in a controller, and no tests to catch any of it. Modern PHP makes all of these avoidable, but only for developers who have adopted the practices. Testing shows which candidates have, and it does so in an hour rather than over a year of code review.
What strong PHP looks like
- Uses strict types, typed properties, enums and readonly where they help, and can explain what they prevent
- Structures an application with the framework — service container, middleware, jobs — rather than around it
- Writes parameterised queries or uses the ORM correctly, and can spot injection in a review
- Reads the SQL the ORM produces and avoids N+1 with eager loading
- Validates and sanitises input at the boundary, escapes output, and knows the difference
- Writes tests with PHPUnit or Pest and uses them to drive design
- Manages dependencies with Composer and keeps the runtime version current
Ways to assess PHP
Security and performance review
Provide a small Laravel or Symfony feature with a string-built query, an unescaped output, an N+1 and logic in the controller. Ask the candidate to find, fix and explain each.
Pros
Cons
Best for Mid and senior PHP roles.
Build a small feature with tests
Ask for a CRUD feature with validation, an authorisation rule and a queued job, in a capped take-home.
Pros
Cons
Best for Full-stack and product roles.
AI-scored assessment (e.g. Cohesyve)
Generate a PHP task from the job description — a security review, a refactor, a query question — with a rubric. Each candidate receives a different variant; reasoning is scored with the code.
Pros
Cons
Best for Screening a large pool.
Modernisation conversation
Describe a legacy PHP codebase with no types or tests and ask how they would bring it forward without stopping delivery.
Pros
Cons
Best for Senior developers inheriting legacy systems.
Cohesyve
Run a PHP assessment on your next opening
Cohesyve generates a unique PHP task per candidate from your job description, with the scoring rubric attached. Questions are different for every applicant, so they cannot be shared or looked up.
What to test
Modern language use
Whether they write PHP as it is now.
Security
Whether input and output are handled safely.
Data access and performance
Whether they know what the ORM does.
Structure and testing
Whether the application is maintainable.
Sample PHP questions
What does `declare(strict_types=1)` change, and why would you use it?
EntryLook for Disables coercion for scalar type declarations; catches bugs at the call site; the trade-off with legacy code.
This query builds SQL with string concatenation. What is the risk and the fix?
EntryLook for Injection; parameterised queries or the query builder; awareness that escaping is not the fix.
A page loads a list of posts and each post's author. What does the database see, and how do you fix it?
MidLook for N+1; eager loading with the ORM; checking the query log.
Where does business logic belong in a Laravel or Symfony app, and why not the controller?
MidLook for Services, actions or domain objects; controllers coordinate; testability and reuse.
How would you add types and tests to a legacy codebase without stopping feature work?
SeniorLook for Static analysis at a low level and raise it, characterisation tests around risky areas, types at boundaries first, incremental and measured.
Red flags
- Builds SQL by concatenating strings
- Has not used types, enums or static analysis
- Puts business logic in controllers or templates
- Cannot explain what the ORM does under a loop
- Has no testing habit
Scoring rubric
| Criterion | Weight | What strong looks like |
|---|---|---|
| Security | 25% | Input, queries and output are handled safely by habit. |
| Modern practice | 20% | Types, enums and static analysis are used with reasons. |
| Data access | 20% | Queries are efficient and understood. |
| Structure | 20% | Logic lives in the right place; framework is used well. |
| Testing | 15% | Tests exist, run fast, and drive design. |
Mistakes hiring teams make
- Testing trivia about old PHP behaviour
- Skipping security — it is the highest-consequence PHP skill
- Not specifying the framework, then judging framework fluency
- Accepting a working feature with no tests
- Assuming years of PHP means modern PHP
Roles that need PHP
Common questions
Should I test Laravel or plain PHP?
Test the framework the role uses; structure and security judgement show best inside it. Plain PHP questions are useful only for the modern-language section.
What is the single most important PHP screening question?
Show a string-built query and ask what is wrong. Anyone who does not see injection immediately is not ready for production code.
How do I assess WordPress developers?
The same fundamentals — security, data access, structure — plus WordPress-specific hooks and the discipline to keep custom code out of themes. Security matters even more given the attack surface.
How long should a PHP assessment take?
Forty-five to sixty minutes for a review exercise; two to three hours capped for a small feature.
Cohesyve · Skill assessments for hiring
Test PHP before the first interview
Generate a role-specific PHP assessment from your job description and see who can do the work before you spend interview time on them.
1,500+
assessments completed
50%
faster time-to-hire
90%
completion rate
5 min
from JD to assessment
No credit card · 10 free candidates · Plans sized to your hiring volume
From the blog