A Comprehensive Guide to Composer: PHP Dependency Management with a Practical Example

Composer is the dependency manager for PHP. You list the libraries your project needs in composer.json, and Composer downloads the right versions, their own dependencies and an autoloader that loads every class for you. This page gives a short practical example; the full guide covers installation, everyday commands and deployment in depth.

1. What Composer manages

Version constraints usually use ^: "twig/twig": "^3.0" allows any 3.x release from 3.0 up, but never 4.0, which may break your code.

2. Install Composer

• Windows: run Composer-Setup.exe from getcomposer.org.
• macOS: brew install composer.
• Linux or your own VPS: use the official installer from getcomposer.org and check its signature before running it. The full guide has the exact commands.

Check it works with composer --version. Don't run Composer as root inside a project; use your normal user.

3. A practical example: a small project with autoloading

This builds a tiny project that renders a page with the Twig template engine and loads your own classes through Composer's autoloader.

{
    "name": "example/simple-site",
    "require": {
        "php": ">=8.2",
        "twig/twig": "^3.0"
    },
    "autoload": {
        "psr-4": { "App\\": "src/" }
    }
}

src/Greeting.php:

<?php
namespace App;

final class Greeting
{
    public function for(string $name): string
    {
        return 'Hello, ' . $name;
    }
}

public/index.php:

<?php
require __DIR__ . '/../vendor/autoload.php';

use App\Greeting;
use Twig\Environment;
use Twig\Loader\ArrayLoader;

$twig = new Environment(new ArrayLoader([
    'page' => '<h1>{{ message }}</h1>',
]));

echo $twig->render('page', ['message' => (new Greeting())->for('Domain India')]);

Twig escapes {{ message }} for HTML by default, so user input shown this way is safe from basic XSS.

4. Everyday commands

composer require vendor/package        # add a library
composer require --dev phpunit/phpunit # development-only tool
composer install                       # install exactly what composer.lock says
composer update vendor/package         # update one library within its constraint
composer outdated --direct             # which libraries have newer versions
composer audit                         # known security advisories

Use install for deployments and update only when you mean to change versions; then test and commit the new composer.lock.

5. Deploy to Domain India hosting

Shared hosting (cPanel, DirectAdmin, Webuzo): Composer cannot run on the server, so the vendor/ folder comes from your computer or CI.

1. Check your site's PHP version in the control panel.
2. Run composer config platform.php 8.3.0 with that version, then composer update once, so Composer picks releases that run on the server.
3. Build with composer install --no-dev --optimize-autoloader.
4. Zip the project, upload it with File Manager or FTP, and extract it. Keep vendor/ and src/ outside public_html where you can, with only the public folder in the web root.

Jailed SSH access is available on every shared hosting plan (cPanel, DirectAdmin, Webuzo). It is off by default; ask support to enable it for your account. It helps with unzipping and reading logs, but it does not make Composer work.

VPS: self-managed with root access, so Composer runs normally in your deployment script.

App Platform: a PHP app needs its own Dockerfile, where composer install runs as a build step.

The card shows the live price, excluding 18% GST.

Ready to go further? Read the full Composer guide, check PHP disabled functions on shared hosting, or compare cPanel hosting, VPS and the App Platform.