I feel I am the ideal audience for this; the last book about PHP I read was on PHP4, as well as the last code base I worked on. A lot of the book feels wasted, and even more is questionably sound. That said, I did take away something from this book. I have no reason to doubt the author's intentions in writing it.
To talk about things I liked, Chapter 10 on Testing, the content on Filters, the mention of the Built in PHP Server, Date Handling, Component Set Up, and style-guide explanations which the author calls "Standards" (as if PHP didn't have more foundational things to worry about). All of this is generally a good read. More could be said, and it could probably be said better but you can learn something from this stuff.
It's not all roses this book has some issues,
Fluff: Hosting and Installation are entire fluff chapters. Numerous sections are just fluff too, such as "What are Components." (pg.52): the Author calls PHP Components "laser-focused" because, from his perspective, they're supposed to tackle a specific task. How does that make them any more "laser-focused" than CPAN packages or NPM packages? I'm confused by some of this wording. To make it more confusing, he tries to explain it right above where he labels PHP packages as "small" (it's an explained bullet point). There is no juxtaposition, "laser-focused" is presumably the reason why he thinks they're "small" and he wanted to more fluff. The whole section "What are Components" is pretty poor.
Unexplained things (pg.114): you'll see the word "bucket brigade" what the hell is that? It sounds like something the author invented, but it's not! It's actually a PHP term.
Security Confusion (pg.76): The whole section "Sanitize Input" is wrong. You *never* sanitize input going into a database. You always sanitize it coming out for the presentation medium. Even if the user submits a malicious script, what if you want to render it as text later -- outside of the HTML format? This is just goofy novice stuff to me. To his merit, the author also shows how to escape it on presentation. He agrees with me that you shouldn't double escape and says so explicitly on (pg.80). So why talk about escaping/sanitizing input, and then four pages later escaping output with a caveat that you should always escape output and never double escape?
Absent Modern Content: New features on PHP are mysteriously missing: there is no talk of spl.datastructures (which provide real arrays), spl.types, Judy Arrays. When it says Modern PHP, it assumes you're coming from PHP 5.x. There is no sufficient tutorials for me to be convinced that this would take you up from PHP 4.x. At some point, you may have to "relearn" a whole language. This book may supplement a PHP 5.x user's skill set, but you'll have to look elsewhere if you're not up with 5.x yet.
PHP Gotchas & Author Enchantment: PHP is absolutely notorious for requiring language experts to know what not to do, and the gotchas. Professionally, I code in most dynamic languages that host major web projects. Without talking about new arrays, what about the drawbacks of old PHP "arrays"? More and more I feel O'Reilly books are written as marketing text for the language, or for the author's resume. If you don't talk about what sucks in the language and you're not writing to a beginner audience then you're not doing your job. People that read your book have to know where the warts are. This is not sufficiently covered. I think Josh's expertise was too confined to PHP. He's too used to the warts to sufficiently communicate the warts, so they're absent in this book.