As much as we love working with PHP, Register Globals is something that should be filed under "Monumentally Bad Ideas".  And unfortunately, it's something that, at first glance, appears convenient.  If a user submits a form to a PHP script with Register Globals enabled, the script will create a variable for each form element.  However, keep in mind that this allows your end users to set any variable in your script that they like.  Here is a common mistake that we see:
In a situation like this, the author has first run some code to see if the user is logged in or not.  If so, the script will have defined the $logged_in variable.  When the above line of code fires, it will provide the user with some functions only availble to authenticated users.  Innocent enough, yes?  However, to "hack" this, all that a malicious user would need to do is form a URL like http://www.example.com/?logged_in=1.  To turn off Register Globals, add php_flag register_globals off to .htaccess or register_globals = Off to php.ini.  Many administrators ban use of Register Globals entirely, so by developing without it, your script will be more portable.  This is a good thing.

Yes, we know they're annoying.  However, notices provide you with some valuable information you can use both to improve your script and improve your skills as a programmer.  One thing that notices will alert you to is undefined variables.  Continuing with the above example, the fictitous script assumes that the $logged_in variable will be defined if the user is logged in.  Proper programming practice would be a scenario more like $logged_in==1 if the user is logged in and $logged_in==0 if not.  If notices are turned on, PHP will alert you to this.  To turn notices on, add php_value display_errors on and php_value error_reporting 2147483647 to .htaccess or display_errors = On and error_reporting = E_ALL to php.ini.  You can also use ini_set('display_errors', 1); error_reporting(E_ALL); in your PHP script however this will not display parse errors such as a missing quote or bracket.
Security note: you should turn display_errors off for a production server.  It's best to use it only when developing code.

Magic Quotes is a feature of PHP before (but not including) version 6.  It was originally created to help prevent SQL Injection however new thinking is that programmers should write secure code (!) rather than rely on Magic Quotes.  Here is an example of a function that you may pass $_GET, $_POST, and $_COOKIE to.  It will work whether or not Magic Quotes is enabled.

There's nothing worse than having to move servers in a hurry, realizing that you now have a new path to your home directory, and having to change a hardcoded path in dozens of files.  Instead of hardcoding paths, use $_SERVER['DOCUMENT_ROOT'] to have your script discover your document root.  Or, use dirname(__FILE__) to find the directory that the script is located in.  (Note that this is literally dirname(__FILE__) - you don't replace __FILE__ with anything.) Or, use the getcwd function.

You want to do this simply because it's more efficient.  It's faster to write code when you don't have to write the same code over and over, it's faster to modify code when you don't have to modify it in multiple places, and it's easier for other people to read the finished product when the code is short.  If you have to do the same thing more than once in your script, use functions or loops.  If you have to do the same thing in multiple scripts, use include files.

Yes, this will run and will often produce the desired results.  However, the count function will run at every single iteration.  Instead, it's faster to do:

Someone once told us that functions and variables should all be named with as much care as one names their first child.  We agree.  If your naming scheme is effective, one should be able to guess names by looking at other names.  The Mailparse Extension is a good example of effective naming schemes.  Additionally, take care when defining the order of parameters in a function.  One example of why this is a good idea is the strpos function and the str_replace function.  These functions have two strikes against them.  By looking at str_replace, I would assume strpos would be named str_pos.  Additionally, the parameters are in different orders: strpos requires the subject first and str_replace requires the subject last.

For naming functions, we separate words with underscores.  The first word in the name is a word that defines the general group of functions that we're writing, (for ease of identifying what the function is for, and also for ease of sorting when writing documentation) and then use more words as necessary to describe the function.  Similar functions should have parameters in the same order, with parameters that have default values at the end.  For naming database column names, we often use the actual human readable phrase, converted to lower case, with underscores instead of spaces.  This occasionally makes for a slightly long column name, but the advantage is that we can later use str_replace and ucwords to display the name and not need to cross-reference a list of human-readable column names.

There's a great article about using UTF-8 with PHP and MySQL at developer.loftdigital.com.

This is a MySQL tip, however we include it here because a great deal of PHP students also wish to learn MySQL.  SELECT * is not inherently a bad thing to do, however it's often misused.  The only time that it should be used is when you need to select every single column in a table and you do not know in advance what columns the table will have. We see many people selecting all columns in the table but only actually using one or two.  In this case, it's better to do something such as SELECT `first_name`,`last_name`.  This makes for a longer query, however since the entire row is not loaded, your script uses less memory.

Here's an example of where you DO want to use SELECT *.  Let's say you have a program that displays information about customers from a database.  Perhaps one day you decide that you want to keep track of customers' birthdays.  So you add a column to your MySQL table named `birthday`.  When your program displays the information about the customer, it is necessary to see all of the information.  Because in this case columns such as the `birthday` column may be added in the future and we do not yet know what columns may be added, we have satisfied both of the requirements for using SELECT *.

This might not be necessary for quick scripts but it's something we like to do for large projects.  The simplest wrapper is as such:
There are many advantages to this technique.  For example, one may want to use the mysql_error() function to see if the query returned an error, and if so, write the error to a log.  Or, if one is working on a large project with multiple tables, one might want to prefix the tables with something like projectname1_ so that multiple instances of the project may run with different data.  One example of this is the content management system Joomla.  All of Joomla's queries look like SELECT [columns] FROM #__content WHERE... Joomla removes #__ and replaces it with the appropriate table prefix.

Regular expressions are by far the most powerful underused feature of PHP that we see.  Students often avoid using them because they look intimidating.  We agree, however they're easy to get to know in 15 or 20 minutes.  They're often a very simple and efficient solution to data manipulation problems.  If you're a programming student, one can easily impress friends (well, fellow programming students anyway) by being able to read and write complex regular expressions.

It's always a good idea to have documentation at your fingertips.  We certainly don't claim to know every PHP function there is to know (although that would be really cool).  To find documentation on any function, simply go to http://php.net/functionname.  If you don't know the name of the function you need, look up a similar function and see if the one you want is listed as a related function.  Often, you will also find examples and tips on usage.  These are very helpful.  For example, someone wanting to find out if a string is contained within a string might look up preg_match.  However, this operation does not actually require regular expressions, and as the manual will tell you, it is faster in this situation to use strpos instead.