Composer

Introduction

In the previous lesson, PHPMailer showed up with a single line — require 'vendor/autoload.php' — as if the library had simply appeared in the project. That "appearing" is the job of Composer, PHP's standard tool for managing external packages.

If you have used npm with JavaScript or pip with Python, Composer will feel familiar: it downloads the libraries your project depends on, tracks their exact versions, and gives every project a consistent, repeatable way to install its dependencies.

What Is Composer?

Composer is PHP's standard dependency (package) manager. Instead of manually downloading a library's source files and copying them into your project, you describe what your project needs in a file called composer.json, and Composer downloads, tracks, and organizes those packages for you.

Installing Composer

Composer is installed once per machine (not per project) and then used from the command line inside any PHP project. The official installer is available at getcomposer.org, with instructions for Windows, macOS, and Linux.

composer --version

Composer version 2.7.1 2024-02-09 15:26:28

composer.json and composer init

Every Composer-managed project has a composer.json file at its root describing the project and its dependencies. You can create one interactively with composer init, which asks a series of questions, or write it by hand.

composer init

{
    "name": "programinds/demo-app",
    "description": "A simple demo PHP project",
    "require": {
        "phpmailer/phpmailer": "^6.9"
    }
}

The "require" section lists each package and a version constraint. The ^6.9 constraint means "version 6.9 or a later compatible version, but not the next major version," which keeps updates safe from breaking changes.

Requiring a Package

Rather than editing composer.json by hand, the composer require command adds a package and installs it in one step, updating composer.json automatically.

composer require phpmailer/phpmailer

Using version ^6.9 for phpmailer/phpmailer
./composer.json has been updated
Running composer update phpmailer/phpmailer
Loading composer repositories with package information
Updating dependencies
Installing phpmailer/phpmailer (v6.9.1): Extracting archive
Generating autoload files

After this command finishes, the package's source code is available inside your project, and it can be loaded through Composer's autoloader — the exact mechanism the next lesson explains in depth.

The vendor Folder and composer.lock

Running composer require or composer install creates a vendor/ folder containing the actual downloaded source code of every dependency, plus Composer's autoloading files. Alongside it, Composer writes (or updates) a composer.lock file recording the exact version of every package that was installed.

composer install

Packagist

When you run composer require phpmailer/phpmailer, Composer looks up that package on Packagist (packagist.org), the main public package repository for PHP. Packagist is to PHP what npm is to JavaScript or PyPI is to Python — a searchable index of open-source packages anyone can publish to and install from.

Common Mistakes

Best Practices

Frequently Asked Questions

Key Takeaways

Summary

Composer gives PHP projects a standard, reliable way to pull in third-party code: describe what you need in composer.json, install it with composer require, and let composer.lock guarantee everyone gets the same versions.

Installing a package is only half the story — the next lesson explains autoloading, the mechanism that makes every installed class available in your code without a mountain of manual require statements.