PHP Composer Autoload — Complete Guide to Dependency Management

In this tutorial, you will learn about PHP Composer Autoload. We cover key concepts, practical examples, and best practices to help you master this topic.

Composer is PHP's dependency manager that handles package installation, autoloading, version management, and ensures reproducible builds across environments.

What You'll Learn

By the end of this tutorial, you'll initialize Composer projects, install and manage dependencies, configure PSR-4 autoloading, understand version constraints, and use scripts.

Why Composer Matters

Before Composer, PHP projects bundled manual dependencies or relied on PEAR. Composer automates dependency resolution, autoloading, and version management, making PHP projects portable and maintainable.

Real-World Use

A Laravel project depends on 50+ packages. Composer installs them all, resolves version conflicts, generates an optimized autoloader, and locks versions in composer.lock for consistent deployments.

Composer Learning Path

flowchart LR
  A[Namespaces] --> B[Composer]
  B --> C[DI]
  C --> D[MVC]
  D --> E[REST API]
  A --> F{You Are Here}
  style F fill:#f90,color:#fff

Installing Composer

php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
php composer-setup.php
php -r "unlink('composer-setup.php');"
# Or install globally:
mv composer.phar /usr/local/bin/composer

Initializing a Project

composer init
# Or create composer.json manually:

{
    "name": "myapp/myapp",
    "description": "My PHP Application",
    "type": "project",
    "require": {
        "php": ">=8.1",
        "monolog/monolog": "^3.0"
    },
    "autoload": {
        "psr-4": {
            "App\\": "src/"
        }
    }
}

Installing Packages

composer install           # Install from composer.lock
composer update            # Update all packages
composer require monolog/monolog  # Add a package
composer require --dev phpunit/phpunit  # Dev dependency
composer remove monolog/monolog  # Remove a package

PSR-4 Autoloading

{
    "autoload": {
        "psr-4": {
            "App\\": "src/",
            "App\\Models\\": "src/Models/"
        }
    }
}

<?php
require __DIR__ . "/vendor/autoload.php";
use App\Models\User;
$user = new User("Alice");

Version Constraints

{
    "require": {
        "monolog/monolog": "^3.0",       // >=3.0, <4.0
        "guzzlehttp/guzzle": "~7.0",     // >=7.0, <7.1
        "phpunit/phpunit": "10.*",       // >=10.0, <11.0
        "laravel/framework": ">=10.0 <11.0",  // Exact range
        "acme/package": "dev-main"       // Dev branch
    }
}

Scripts and Hooks

{
    "scripts": {
        "test": "phpunit",
        "cs-fix": "php-cs-fixer fix src/",
        "pre-update-cmd": [
            "@clear-cache"
        ],
        "post-install-cmd": [
            "App\\Setup::initialize"
        ]
    }
}

composer run test
composer run cs-fix

Common Mistakes

1. Committing vendor Directory

The vendor directory should be in .gitignore. Run composer install during deployment instead.

2. Using require Instead of require-dev

Dev tools (testing, coding standards) belong in require-dev. Production should not install them.

3. Not Locking Versions

Always commit composer.lock. It ensures all environments use the exact same dependency versions.

4. Running composer update in Production

composer update changes versions. Use composer install which uses composer.lock.

5. Forgetting to Run composer dump-autoload

After adding or changing autoload configuration, run composer dump-autoload to regenerate the autoloader.

Practice Questions

1. What does Composer do?

Manages PHP dependencies: installs packages from Packagist, autoloads classes, and version-locks dependencies.

2. What is the difference between composer install and composer update?

install uses composer.lock (predictable). update resolves latest versions and updates composer.lock.

3. What is PSR-4 autoloading?

A standard mapping namespace prefixes to directory paths. App\Models\User auto-loads from src/Models/User.php.

4. What is the vendor directory?

Where Composer installs packages. It's generated and should not be committed to version control.

5. Challenge: Set up a Composer project with PSR-4 autoloading and a dependency.

{
    "require": { "monolog/monolog": "^3.0" },
    "autoload": { "psr-4": { "App\\": "src/" } }
}

<?php
require "vendor/autoload.php";
use Monolog\Logger;
use Monolog\Handler\StreamHandler;
$log = new Logger("app");
$log->pushHandler(new StreamHandler("app.log", Logger::WARNING));
$log->warning("This is a warning");

FAQ

Mini Project: Composer Project Setup

Create a PHP project with Composer, PSR-4 autoloading, and Monolog logging.

mkdir myapp && cd myapp
composer init --name="myapp/app" --type=project
composer require monolog/monolog

{
    "autoload": { "psr-4": { "App\\": "src/" } }
}

<?php
// src/Helpers/Logger.php
namespace App\Helpers;
use Monolog\Logger;
use Monolog\Handler\StreamHandler;
class AppLogger {
    public static function create(): Logger {
        $log = new Logger("app");
        $log->pushHandler(new StreamHandler(__DIR__ . "/../../logs/app.log", Logger::DEBUG));
        return $log;
    }
}

What's Next

PHP Dependency Injection PHP MVC Pattern PHP REST API