Dynamic Hosting

About this part

A static site sends the same file to everyone. A dynamic site builds each page when you ask for it. Your Instagram feed and your bank balance are both dynamic pages. This part shows you how dynamic hosting works, using PHP, the most common language on shared and small-business servers.

You will build the two classic stacks step by step. LAMP is Linux, Apache, MySQL and PHP. LEMP is Linux, Nginx (pronounced "engine-x"), MySQL and PHP-FPM. You will set up both on Amazon Linux 2023 and on Ubuntu. Then you will write a small PHP + MySQL application that uses prepared statements, the main defence against SQL injection. Finally you will apply safe PHP settings, such as hiding error details from visitors.

Example: many small Indian businesses run WordPress, which is built on PHP and MySQL. If they misconfigure it, attackers can read errors that reveal file paths or database names. Seeing how the stack fits together helps you see where such leaks happen.

This same kind of stack powers the live project in Part 8 and the practice apps you test safely later.

Related stacks. The same ideas apply beyond PHP. Python apps use Gunicorn, Node.js apps use PM2, Java apps use Tomcat and .NET apps use Kestrel behind nginx. Prepared statements exist in every language: PDO in PHP, PreparedStatement in Java, parameterised queries in Python, Node.js and .NET.

After this part you will be able to

1. Explain the difference between static and dynamic pages.
2. Set up LAMP and LEMP on two operating systems.
3. Write a PHP page that uses prepared statements.
4. Apply safe PHP settings such as display_errors = Off in production.

A real-world picture

Suppose we are a junior developer at a Zoho-style software company maintaining a small PHP portal. A security review flags a search box built with string concatenation. With this part you rewrite it with PDO prepared statements and show the reviewer that the same input no longer changes the query. Globally, WordPress (PHP) runs a very large share of websites, so PHP security habits protect a lot of the web. Everyday analogy: a form with fixed boxes. You can only write in the boxes, not change the form.

Beginner questions I get in class

Q. Is PHP still worth learning in 2026?
Yes, for security learners. Huge numbers of websites still run PHP (WordPress, Laravel), so you will see it in real assessments.

Q. Why both Amazon Linux and Ubuntu?
Companies use both. The package names, paths and service names differ, and knowing both saves hours at a new job.

Q. What if my PHP page downloads instead of running?
PHP-FPM is not connected. Check the location ~ \.php$ block and that php-fpm is running.

Q. Can I skip prepared statements for a small project?
No. Small projects become big ones, and the habit costs nothing.

Key terms

• PHP-FPM: A separate service that runs PHP for nginx.
• LAMP / LEMP: Linux + Apache or nginx + MySQL + PHP.
• Prepared statement: A query with placeholders. Data is sent separately, so it cannot change the SQL.
• display_errors: A PHP setting. Keep it Off in production so visitors never see file paths.
• Session cookie: A small ID the browser sends back so the app remembers you. Mark it HttpOnly and Secure.

Mini case study

Suppose we are a junior analyst at Tata Consultancy Services, asked to review a new web server on AWS before launch (with the client's written approval). The checklist from this part becomes a short report: what you checked, what you found (for example "port 22 open to 0.0.0.0/0" or "directory listing on"), the evidence (a command and its output), and the fix. Clear, evidence-based reports like this are how defenders work every day.