Access Modifiers

Introduction

So far, every property and method in our examples has been marked `public`, meaning any code anywhere could read or change it directly. Real applications need more control than that. What if a bank account balance could be set to any value by any code that touched the object? Access modifiers exist to prevent exactly that kind of problem.

PHP gives you three access modifiers — `public`, `protected`, and `private` — that control exactly which code is allowed to read or modify a property, or call a method.

The Three Access Modifiers

Every property and method in a PHP class can be marked with one of three visibility keywords.

<?php
class Employee
{
    public string $name;        // anyone can read/write this
    protected float $salary;    // only Employee and its subclasses
    private string $ssn;        // only Employee itself

    public function __construct(string $name, float $salary, string $ssn)
    {
        $this->name = $name;
        $this->salary = $salary;
        $this->ssn = $ssn;
    }
}

$e = new Employee("Priya", 65000, "000-00-0000");
echo $e->name . "\n"; // OK, public
// echo $e->salary; // Error: Cannot access protected property
// echo $e->ssn;    // Error: Cannot access private property

Priya

The commented-out lines would each cause a fatal error if uncommented, because code outside the class has no way to reach a `protected` or `private` member directly.

Visibility Summary Table

Read the table left to right for each modifier: `public` is accessible everywhere, `protected` is accessible inside the family of classes (the defining class plus any subclass), and `private` is locked to the exact class that declared it.

Why Restrict Access?

Restricting access is not about hiding information out of secrecy — it is about encapsulation: bundling data together with the only code that is allowed to change it, so the object can guarantee its own rules are never broken.

This matters more as codebases grow. In a small script, a public property is harmless. In a large application maintained by many developers, an object with public properties has no way to protect itself from being put into an invalid state by code written somewhere else entirely.

Worked Example: Getters and Setters

A common pattern is to make a property `private`, then expose controlled access to it through public methods — often called a getter (to read the value) and a setter (to change it, with validation).

<?php
class BankAccount
{
    private float $balance;

    public function __construct(float $startingBalance = 0.0)
    {
        $this->balance = $startingBalance;
    }

    // Getter: read-only access to the balance
    public function getBalance(): float
    {
        return $this->balance;
    }

    // Setter: controlled, validated way to change the balance
    public function deposit(float $amount): void
    {
        if ($amount <= 0) {
            echo "Deposit must be positive.\n";
            return;
        }
        $this->balance += $amount;
    }

    public function withdraw(float $amount): void
    {
        if ($amount > $this->balance) {
            echo "Insufficient funds.\n";
            return;
        }
        $this->balance -= $amount;
    }
}

$account = new BankAccount(100.0);
$account->deposit(50.0);
$account->withdraw(30.0);
$account->withdraw(1000.0);

echo "Final balance: \${$account->getBalance()}\n";

Insufficient funds.
Final balance: $120

Nothing outside `BankAccount` can touch `$balance` directly — every change is forced through `deposit()` or `withdraw()`, which can reject invalid values. The object protects its own integrity, which is the entire point of encapsulation.

Common Mistakes

Best Practices

Frequently Asked Questions

Key Takeaways

Summary

Access modifiers give you fine-grained control over what code is allowed to touch a class's internals. By defaulting to private and exposing only what is truly needed through public methods, you keep objects in charge of their own valid state — the core idea behind encapsulation.