PHP is probably the easiest to learn mainstream language available right now. This comes with a price though; poor design and vulnerabilities are to be found on a huge amount of php projects, just because PHP allows you to do so, and because many of the people who are using the language are not (or should not call them selves) professional programmers.
A few of the most important things:
Make sure you have error_reporting to at least E_NOTICE during development, or even better to the suggested E_STRICT (for PHP5 and above). PHP is very good in warning you about possible bugs of vulnerabilities in your code.
Be careful though: as nice and helpful as it may be to use error reporting during development, make sure NO errors are displayed on the actuall application while live; it can give the person who is currently using it allot of info about your vulnerabilities! So, on the live project, make sure error_reporting
is disabled.
Exception handling is a powerful technique to protect your program flow and get running errors.
If I would start programming now, I would definitely begin with OOP. After 10 years of programming experience, I am convinced that even the smallest project can benefit hugely by taking the OOP approach, for various reasons. Cleaner code, better control over your project, and very important, better scaling.
I have been confronted with this problem many times in my early days when I was still not using OOP: you start with a small project, and before you know it you want to add so many features that you get lost in the end dealing with hundrets of scattered functions and files.
Don't be discouraged by the longer time OOP may take you to think about your code before you start; you will do things in a fraction of the time it would otherwise take later. If you need more info about OOP advantages, here is a relevant StackOverflow discussion.
Set register globals OFF!
Make sure you protect your sql reads/writes against malicious input (sql injection). You will find noumerous articles on how to protect your self against this. For me, among other things the mysql_real_escape_string is a must!
Also you should be aware of SQL Injection.
Books
My first book was "Beginning PHP5, Apache, and MySQL Web Development (Programmer to Programmer)" for the PHP4 verion. I was a beginner then, and I found it excellent. I assume the php5 version should be as good.
If you are already familiar with programming maybe you should get this one. PHP5 Power Programming is also decent.
Those two combined should bring you in track.
Have you ever fallen into the equality operator trap, where you want to check if 2 values are equal but end up assigning a value to the variable? for example:
if ($var = 'something') { //code to execute }
This code will execute, ASSIGNING the value of something to $var instead of checking for equality. Instead, reverse the order:
if ('something' == $var) { code to execute }
if ('something' = $var) returns an error, and since $var could be anything from a simple trivial number to a session determining access levels, I highly recommend this approach.