PHP, HTML and SQL: From MySQL to MariaDB
How a web page, server-side code and a relational database work together — with history, freedom and safer design.
עברית
Three layers, three different jobs
A dynamic website becomes easier to understand when its responsibilities are separated. HTML describes the document presented to a visitor. PHP executes application logic on the server. SQL expresses operations on structured data, handled by a database such as MariaDB or MySQL. The browser does not need the database password or PHP source to display the resulting page. Keeping that boundary clear is fundamental to both maintenance and security.
Consider a community article directory. The visitor requests a page; PHP checks the request, asks the database for published articles, and produces HTML. The browser receives headings, text and links. CSS controls presentation, while JavaScript can add optional interaction. A page can remain useful even when no browser script runs.
| Technology | Where it works | Responsibility |
|---|---|---|
| HTML | Browser | Document structure and meaning |
| PHP | Server | Application logic and HTML output |
| SQL | Database server | Queries, changes and data relationships |
| MariaDB / MySQL | Database server | Store data and execute SQL |
From early PHP to a maintainable service
Rasmus Lerdorf’s early tools became publicly available in 1995; PHP 3 followed in 1998. The language grew from practical web development needs into a broad server-side ecosystem. Today the useful lesson is not to copy decades-old deployment habits. Keep a supported runtime, understand your dependencies and make configuration reproducible. On a Linux web server, an independently configured PHP-FPM pool can provide an explicit execution boundary for a site.
We recommend treating a blog as a small production service: keep templates readable, separate secrets from published files and record the dependencies needed to restore it. More features do not automatically improve the visitor’s experience. A clear HTML page with a reliable form can be more useful than a complicated interface that is hard to maintain.
MariaDB came from MySQL; MySQL still exists
MariaDB originated as a fork of MySQL and was developed by members of the original MySQL team. MariaDB Server remains available under GPLv2. It is a separate project, not a new name for every modern MySQL installation. Both systems are used today. Shared roots explain their familiar SQL and client interfaces, but compatibility should be checked for the particular application and versions.
Before migration, inventory storage engines, collations, authentication, SQL modes and database-specific functions. Test the application against a restored copy. Do not assume that moving data files between different server families is a valid migration method. A rehearsal should include both the move forward and the route back if application behaviour changes.
SQL is a language, not a storage product
Tables describe entities and relationships. An article can have an identifier, title and publication flag; authors can live in a separate table. An SQL query asks for a result, and the database chooses an execution strategy. Useful indexes and appropriate data types matter more than the simple claim that one database is always faster.
Start with the application’s actual operations. Which pages read the same data repeatedly? Which changes must succeed together? What is the expected size of the data? Those questions lead to a design that can be explained and measured.
Keep data separate from instructions
Use prepared statements for values, rather than concatenating request text into SQL. Placeholders do not substitute for SQL identifiers: a user-selected sort column needs a fixed allow-list. Database permissions should match the application’s tasks rather than granting a web process administrative powers.
$stmt = $pdo->prepare(
'SELECT title FROM articles WHERE id = :id AND published = 1'
);
$stmt->execute(['id' => $validatedId]);
$title = $stmt->fetchColumn();
if ($title !== false) {
echo htmlspecialchars($title, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
}This fragment assumes an existing PDO connection and a validated integer identifier. It illustrates separate SQL parameter binding and escaping for HTML text; it is not a complete application.
Freedom also needs responsible operation
Published source and suitable licences make inspection and independent maintenance possible. They do not remove the need for updates, backups or access control. Store password hashes with the appropriate password API instead of plaintext passwords, and keep diagnostic details out of public error pages. Our recommendation is to practise restoring the whole service, including its configuration, before depending on it. For another database architecture, read our PostgreSQL article.