Advanced PHP and MySQL
Advanced PHP and MySQL is a follow-on course in secure, standards-based web programming with PHP 8.5 and MySQL, covering user accounts, PDO, advanced queries and transactions. It suits people who already know basic PHP and junior programmers, and you leave able to build a news system, a photo gallery, a web board and an online shop yourself.
- Duration18 hours · 3 days
- FormatOnsite / live online
- Next roundOn request
- CertificateIncluded
Course overview
PHP and MySQL still power a great many websites and business systems, yet much of the sample code around is written the old way: SQL built by joining strings, passwords stored unsafely, functions that have since been removed, or jQuery for everything. Sites built like that are open to attack and hard to maintain, so anyone who already knows basic PHP should move on to secure, current practice.
This course takes web programming with PHP 8.5 and MySQL 9.7 LTS further. Learners set up their tools with Docker and Composer, write modern PHP, handle forms, sessions and cookies safely, build user accounts with password_hash and organise the project with OOP. They then design databases, write advanced queries through PDO, use transactions and indexes, build a news system with RSS, upload and resize images and stop spam with CAPTCHA. The course continues with the Fetch API, scheduled email with cron and workshops that build a web board and an online shop, and closes with a security checklist and deployment. (3 days, 6 hours per day, 18 hours in total, Intermediate level.)
What you’ll gain
- Write modern PHP 8.5 and organise projects with OOP and Composer
- Handle forms, sessions and cookies securely, preventing XSS and CSRF
- Build user accounts that store passwords correctly with password_hash
- Design databases and write advanced queries through PDO prepared statements
- Use transactions and indexes to keep data correct and the system fast
- Build a news system, image uploads, email sending and cron jobs
- Develop a web board and an online shop with a shopping cart on your own
Who this course is for
- People who already know basic PHP and MySQL and want to apply them to real work
- Junior programmers who want to write secure, standards-based web code
- Staff who look after company websites and business systems built in PHP
- Students who want to build serious projects with PHP and MySQL
- Teachers and lecturers who want to update how they teach PHP web development
Prerequisites
- Able to build web pages with HTML and CSS (basic guidance is given if you are not yet confident)
- Some experience of basic PHP and MySQL, such as variables, conditions and SELECT
- Able to install and uninstall basic software and use the internet confidently
- A laptop that can run Docker Desktop and VS Code, with permission to install software
Curriculum
Course Details
This course is the 2026 edition of Advanced PHP and MySQL, rewritten and updated for PHP 8.5 and MySQL 9.7 LTS. It runs for 3 days, 6 hours per day (18 hours in total, 09:00-16:00), as lectures with workshops that build on a single starter project. Intermediate level. It takes learners from basic PHP and MySQL to secure web code and real business systems, while RESTful APIs and frameworks such as Laravel are covered in separate follow-on courses. Every lab runs on the learner's own machine with Docker. Learners take home a lab guide, the source code for the news system, web board and online shop, and docker-compose files.
Day 1 Modern PHP and Security
Section 1: Lab: Setting Up a PHP 8.5 Environment
- Run PHP 8.5, MySQL 9.7 LTS and phpMyAdmin with Docker Compose
- Set up VS Code and read errors systematically during development
- Install packages with Composer and use autoloading
- Keep settings and database passwords in an .env file
- Lab: create the starter project used in every workshop
Section 2: PHP 8 Essentials for Real Work
- Type declarations, match, enums and readonly
- Named arguments, the nullsafe operator and the pipe operator in PHP 8.5
- Commonly used string, number and array functions
- Dates and times with DateTimeImmutable and time zones
- Lab: write your own form validation functions
Section 3: Forms, Sessions and Cookies Done Safely
- Validating and filtering input with filter_var and your own rules
- Sessions and cookies with HttpOnly, Secure and SameSite settings
- Preventing XSS by escaping everything you output
- Preventing CSRF with form tokens
- Lab: a contact form that validates fully and remembers what was entered
Section 4: Lab: User Accounts and Login
- Store passwords with password_hash and check them with password_verify
- Sign up, log in and log out
- User and administrator roles
- Limiting repeated failed login attempts
- Password reset with tokens that expire
Section 5: OOP and Project Structure
- Classes, interfaces, namespaces and constructor promotion
- PSR-4 autoloading with Composer
- Separating presentation, request handling and database access
- Error handling with exceptions and logging
- Lab: reorganise the starter project into a clean structure
Day 2 Advanced MySQL and Content Management
Section 6: Designing Databases That Are Easy to Maintain
- Normalising just enough, with examples from real projects
- Choosing data types and using utf8mb4 for Thai text and emoji
- Primary keys, foreign keys and constraints
- Creating database users and granting privileges for the application
- Lab: design the shop and web board databases in phpMyAdmin
Section 7: Lab: PDO and Advanced Queries
- Connecting with PDO and prepared statements to prevent SQL injection
- Joins across several tables, subqueries and GROUP BY
- CTEs and window functions for reports
- Searching with several kinds of conditions, and pagination
- Lab: a product list page with search, filters and pagination
Section 8: Transactions and Performance
- Transactions with beginTransaction, commit and rollBack
- Locking rows with SELECT ... FOR UPDATE when reducing stock
- Creating indexes and reading EXPLAIN output
- Cutting down repeated queries on a page
- Lab: save orders correctly even when customers buy at the same time
Section 9: Lab: A News System with Rich Text and RSS
- Design tables for news, categories and readable URLs
- Use a rich text editor so users can format content
- Filter unsafe HTML before saving and displaying it
- Generate an RSS feed that other systems can read
- Lab: a news system with an administrator back end
Section 10: File Uploads, Images and CAPTCHA
- Secure uploads: check type and size, and rename files
- Resize images, create thumbnails and convert to WebP with GD
- Build a photo gallery from uploaded images
- Stop spam with a GD-based CAPTCHA or an external service such as Cloudflare Turnstile
- Lab: a gallery that uploads several images and resizes them automatically
Day 3 Interactive Pages and Real-World Workshops
Section 11: Lab: JavaScript, the Fetch API and JSON
- Modern JavaScript alongside PHP, in place of jQuery
- Writing PHP endpoints that return JSON
- Submitting forms with the Fetch API without reloading the page
- Validating in the browser as well as on the server
- Lab: sign-up and comments without a page reload
Section 12: Email and Scheduled Jobs
- Send plain text and HTML email over SMTP with PHPMailer
- Queue emails in the database instead of sending them immediately
- Set up a cron job to send email automatically from the server
- A mailing list with unsubscribe links and PDPA consent
- Lab: send newsletters to members at a scheduled time
Section 13: Workshop: A Multi-Group Web Board
- Board groups, new topics and replies
- Approving or rejecting posts and reporting inappropriate ones
- Filtering offensive words and adding emoji to posts
- Managing many items at once with checkboxes
Section 14: Workshop: An Online Shop
- A back end for product categories, products and images
- Product search and a session-based shopping cart
- Checkout that reduces stock inside a transaction
- Managing customers and order status
- Sending order confirmation emails to customers
Section 15: Security and Deployment
- A security checklist based on the OWASP Top 10 for PHP sites
- Production php.ini settings and hiding errors from users
- Deploying to shared hosting or a VPS and backing up with mysqldump
- Using an AI assistant to review code, and checking its advice before using it
- Present the work and look at next steps towards Laravel
Schedule & training options
For individuals — public rounds
No public rounds are open right now. Join the waiting list and we will contact you first when the next round opens, or ask us on LINE. Or call 02-570-8449 or 088-807-9770
For organisations — in-house / private
- Tailor the content to your team’s tools and projects
- Your dates, at your office or live online
- Quotation with tax ID for procurement
Instructors
Frequently asked questions
What is a transaction in MySQL and when should you use one?
A transaction groups several SQL statements so they succeed or fail together. If everything works you confirm it with COMMIT; if any statement fails you undo the lot with ROLLBACK, so data is never left half-updated, for example when saving an order while reducing stock. In PHP you use PDO's beginTransaction, commit and rollBack, and lock rows with SELECT ... FOR UPDATE when several users may change the same data. Tables must use InnoDB, the default in current MySQL.
How do you prevent SQL injection in PHP?
The reliable fix is to use prepared statements with PDO, passing user input as parameters kept separate from the SQL rather than joining strings into a query, and to set PDO to report errors as exceptions. Combine this with validating form data, for example checking that a field is a number or an email address, escape anything you display with htmlspecialchars() to prevent cross-site scripting (XSS), and give the application a database user with only the privileges it needs.
How do you paginate results with PHP and MySQL?
First count all rows with SELECT COUNT(*) and divide by the number of items per page to get the page count. Read the page number from the URL and check it is a valid number, work out the starting row as (page - 1) × items per page, then fetch the rows with LIMIT and OFFSET through a prepared statement. Finally, build links for previous, next and numbered pages. This course includes a workshop on a product list with search and pagination.
Who is the Advanced PHP and MySQL course for, and what should I know beforehand?
It suits people who already know basic PHP and MySQL, junior programmers, staff who look after company websites, students working on projects and teachers who want to update how they teach. You should be able to write HTML and CSS and have some experience of basic PHP and MySQL; basic guidance is given if you are not yet confident.
What will I be able to do after the Advanced PHP and MySQL course?
You will be able to write modern PHP 8.5 and organise projects with Composer, build secure user accounts, prevent SQL injection, XSS and CSRF, design databases and write advanced queries with transactions, and build a news system with RSS, a photo gallery with automatic resizing, CAPTCHA, scheduled email with cron, a web board and an online shop. Participants who complete the training receive a Certificate of Completion with its own number, which can be verified online.
Can the Advanced PHP and MySQL course be run in-house for our team?
Yes. It can be run in-house for your team, with examples adapted to your own work, such as using systems your team already maintains to practise making existing PHP code more secure. You can request a quotation from this page, or contact us on LINE @itgenius or by phone on 02-570-8449.
Related articles
Articles are published in Thai.