Composer Setup and PHP Settings

01What Is Composer and Why Do You Need It?

Composer is the dependency manager for PHP projects. It downloads the libraries your project needs, with compatible versions, and lets you manage them from a single file. Composer is to PHP what npm is to JavaScript and pip is to Python.

Composer’s second big contribution is autoloading. Instead of writing dozens of require lines, you include a single file; classes are loaded automatically the moment they are needed. Modern PHP frameworks such as Laravel and Symfony are built on Composer from the ground up.

Libraries are published in a public repository called Packagist. Composer picks suitable packages from this repository according to the version rules in your composer.json file and installs them all into the vendor folder.

02Installing PHP: Windows, macOS, Linux

Composer is a PHP program, so PHP must first work on the command line. If XAMPP is installed on your computer, you can use the PHP inside it; details are in our XAMPP setup guide. If you want to install a standalone PHP, follow the steps for your operating system.

php -v

# Installed extensions
php -m

# The php.ini file in use
php --ini

PHP on Windows

Download the x64 Thread Safe zip of the current stable release from windows.php.net and extract it to a short folder such as C:\php. Create a copy of the php.ini-development file in the folder named php.ini, and add the C:\php folder to the system PATH.

In php.ini, enable the extensions that Composer and most packages need by removing the semicolon at the start of the line:

extension_dir = "ext"
extension=curl
extension=fileinfo
extension=mbstring
extension=openssl
extension=pdo_mysql
extension=zip

PHP on macOS and Linux

On macOS a single command with Homebrew is enough. On Ubuntu and Debian, install the PHP command-line package together with commonly used extensions and the unzip tool; Composer needs unzip or the zip extension when extracting packages.

brew install php

sudo apt update
sudo apt install php-cli php-mbstring php-xml php-curl php-zip unzip

03Composer Setup Step by Step

The easiest way on Windows is the Composer-Setup.exe installer at getcomposer.org. The installer finds php.exe on your computer, reports missing settings and adds the composer command to PATH. After installation, close and reopen any open terminals.

On macOS and Linux, Composer is installed with the four-line command on the download page. One of these commands verifies the security hash of the downloaded file and changes with every release; so always copy the commands in their current form from the official page. The installation creates a composer.phar file in the folder you are in; by moving it to a global location, you can run it by typing composer from anywhere.

php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
# (the hash verification line on the official page)
php composer-setup.php
php -r "unlink('composer-setup.php');"

# Move to the global scope
sudo mv composer.phar /usr/local/bin/composer

composer --version
composer diagnose

04composer install and Basic Commands

In a new project, composer init creates composer.json through interactive questions. If you have cloned an existing project, all you need to do is run composer install: Composer installs the exact versions in the composer.lock file.

composer require adds a new package and updates composer.json and composer.lock. composer update upgrades to the newest versions within the allowed version range, so it should be used deliberately within a team.

• The ^2.0 version rule allows all versions within 2.x and does not move to 3.0.
• Share the composer.lock file; everyone on the team and the server installs the same versions.
• Don’t commit the vendor folder to Git; add it to .gitignore.

# Create a new project file
composer init

# Paket ekle
composer require guzzlehttp/guzzle

# Package needed only for development
composer require --dev phpunit/phpunit

# Install according to the lock file
composer install

# Update versions
composer update
composer outdated

# Remove a package and list packages
composer remove guzzlehttp/guzzle
composer show

Security audit

Check whether the packages you use have a known vulnerability with the composer audit command. The command compares the versions in the lock file against open databases and lists the affected packages. Running this check after every update and at regular intervals keeps an outdated library from putting your site at risk.

composer audit

Composer scripts

You can write your frequently used commands in the scripts field of composer.json; for example a test script that runs the tests. These scripts run with composer run-script test or simply composer test. That way everyone on the team uses the same command with the same parameters, and a new developer sees at a glance how the project is tested.

05PSR-4 Autoloading

Use Composer not only for external packages but also to organize your own code. In the PSR-4 standard each namespace corresponds to a folder; for example, the App\Servis\Fatura class lives in the file src/Servis/Fatura.php.

After adding the setting to composer.json, run the composer dump-autoload command. From now on, you only need to include vendor/autoload.php in the project’s entry file.

{
  "require": {
    "php": ">=8.1"
  },
  "autoload": {
    "psr-4": {
      "App\\": "src/"
    }
  }
}

<?php
require __DIR__ . '/vendor/autoload.php';

use App\Servis\Fatura;

$fatura = new Fatura();

composer dump-autoload

06Installing on a Live Server

A live server doesn’t need development packages, and optimizing the autoloader saves time on every request. Use the command below during deployment; --no-dev leaves out test tools, and --optimize-autoloader builds the class map in advance.

This small setting has a positive effect on response time, especially in projects with many classes. We treat server-side improvements like this as part of our speed and performance management work.

Running composer validate locally before deployment is also a good habit: it checks for typos in composer.json and whether the lock file is up to date. That reduces the chance of running into a half-finished install on the server.

• The PHP version on the server must satisfy the php rule in composer.json.
• If you use a different PHP version locally, you can mimic the server’s version with the config.platform.php setting in composer.json.
• To match environments exactly, running PHP inside a container is also an option; see Docker setup.

composer install --no-dev --optimize-autoloader

07Common Errors and Fixes

Most Composer errors come from missing PHP extensions, an incompatible PHP version and memory limits. The composer diagnose command detects many problems by itself.

• php command not recognized: The PHP folder is not in PATH; add it and reopen the terminal.
• openssl extension missing: Enable the extension=openssl line in php.ini; make sure you are editing the right php.ini file with php --ini.
• zip extension and unzip command missing: On Windows enable the extension=zip line, on Linux install the php-zip and unzip packages.
• Your requirements could not be resolved: The package doesn’t support your installed PHP version or the version of another package. Read the requirement in the error text and choose the PHP or package version accordingly.
• Allowed memory size exhausted: Run the command as COMPOSER_MEMORY_LIMIT=-1 composer update, or increase the memory_limit value in php.ini.

08Next Steps with Composer

Most PHP projects work with a database. Before connecting a database layer you installed with Composer, you can prepare your local server with our MySQL setup guide. For more PHP content, see the php tag page.

Properly set up dependency management lets a corporate website, or an integration project that connects to payment and shipping services, be updated safely over the years. Aurora Yazılım’s e-commerce infrastructure is also built without ready-made themes, with a design unique to each company.