PHP Cheatsheet - PHP & Composer Command Reference
This reference is for developers writing PHP apps and the people who deploy and operate them, running everything from single scripts to Laravel projects. It covers executing code on the CLI, the built-in dev server, Composer dependency and autoload management, extension/ini checks, and the php -l lint gate. Unlike a generic PHP command dump, entries are grouped by the workflow you actually repeat when scaffolding, debugging, and shipping a PHP application. After reading, you should be able to boot a Composer-based project locally, keep its autoload in sync, and gate merges on a lint pass.
CLI Run 8
php script.phpphp -aphp -S localhost:8000php -S localhost:8000 -t public/php -l script.phpphp -r "echo phpinfo();"php -iphp -mComposer Dependency 10
composer initcomposer installcomposer updatecomposer require vendor/packagecomposer remove vendor/packagecomposer dump-autoloadcomposer dump-autoload -ocomposer showcomposer outdatedcomposer self-updateExtensions & Config 6
php --iniphp -d memory_limit=256M script.phpphp -d display_errors=1 script.phppecl install extensionpecl uninstall extensionphp -r "echo PHP_VERSION;"Laravel Commands 8
php artisan servephp artisan migratephp artisan migrate:freshphp artisan make:model Post -mcrphp artisan route:listphp artisan config:cachephp artisan queue:workphp artisan tinkerProfiling 4
php -d xdebug.mode=profile script.phpphp -d opcache.enable_cli=1 script.phpstrace -p <pid>php -r "echo memory_get_peak_usage();"Command Examples
Catching syntax errors before commit with php -l
php -l script.phpIt never executes the code, so problems inside function bodies or config loading stay hidden; only syntactic errors are caught. Running it across a directory in CI after passing it locally saves a full pipeline cycle.
Output
No syntax errors detected in script.php
Confirming an extension is genuinely loaded
php -m
php --iniWhen an extension is missing from php -m, first check whether the ini files in the Scan directory enable it — installed-but-not-enabled is the most common false alarm. Web and CLI load different ini files, so a pass here says nothing about the production PHP-FPM pool.
Output
[PHP Modules] ctype curl dom json mbstring openssl pdo_mysql tokenizer Configuration File (php.ini) Path: /etc/php/8.3/cli Loaded Configuration File: /etc/php/8.3/cli/php.ini Scan for additional .ini files in: /etc/php/8.3/cli/conf.d
Deployment wrap-up: rebuilding the autoloader in optimised mode
composer install
composer dump-autoload -o
composer showinstall keeps versions aligned with the lock, and -o materialises a definite class map to cut runtime lookups. The versions composer show reports can be checked against the constraints in composer.json to confirm the deployed tree is the intended one.
Output
Loading composer repositories and package information Installing dependencies from lock file (including require-dev) Generating optimized autoload files 1 package you are using is looking for funding. monolog/monolog 3.6.0 Structured logging symfony/console 6.4.7 Symfony Console Component
Laravel: inspect routes and backlog before deciding on migrations
php artisan route:list
php artisan migrateroute:list confirms the route is actually registered, so check it before blaming the controller on a 404. Only Migrated counts as success for migrate, and migrate:fresh must stay out of production since it rolls every migration back.
Output
GET / ............................................ posts › index
POST /posts ....................................... posts › store
GET /posts/{post} ............................... posts › show
Migrating: 2026_09_12_000000_create_posts_table
Migrated: 2026_09_12_000000_create_posts_tableCommon Pitfalls
- php -S is a single-process development server: concurrent requests queue and may time out. Local use only — production needs Nginx with PHP-FPM.
- composer update rewrites composer.lock and drags unrelated packages along with it. Use install rather than update in deploy scripts and CI, or production versions will drift over time.
- Options set via php -d apply to that process only (memory_limit, for example) and are written nowhere. Do not expect a relaxed limit from a debugging session to persist.
- php -i dumps configuration paths and extension details as diagnostic output; keep it out of user-visible responses and logs.
- php artisan queue:work runs in the foreground. Under a process supervisor it stays alive unattended — otherwise closing the terminal stops the queue.
Tips
- In production always run composer dump-autoload -o to optimize performance.
- php -S is for development only; use Nginx + PHP-FPM in production.
- In Laravel production, cache config, routes and views: config:cache, route:cache, view:cache.
FAQ
When do I use composer install versus composer update?
It depends on whether you intend to change dependency versions. composer install installs exactly what composer.lock pins, so everyone on the team and every deploy gets an identical dependency tree — that is what makes builds reproducible. composer update ignores the lock, resolves the newest versions permitted by composer.json constraints, and rewrites the lock file. Use install when you only touched application code, and reserve update for deliberate upgrades; otherwise an incidental update drags along packages you never meant to move.
Why does a freshly added class report "class not found" at runtime?
Because the autoload class map was never regenerated. Composer keeps its PSR-4 resolution as a cached mapping inside vendor, so a new class is absent from it and the autoloader cannot locate the file. Running composer dump-autoload rebuilds the mapping without reinstalling anything. On production deploys use composer dump-autoload -o, which resolves the PSR-4 rules into a definite class map ahead of time and removes the per-class filesystem probing at runtime.
php -l only checks syntax — so what is it actually good for?
It is fast, and it catches a large class of production failures before they ship. php -l parses without executing and prints No syntax errors on success, which means you can sweep an entire directory in CI in a few tens of milliseconds without booting the application. Problems that only surface on execution — a missing extension, a bad config file, absent dependencies — are answered separately by php -m and php -i. The sensible split is: syntax via -l, extensions and configuration via -m/-i, runtime behaviour by actually running the script.
The extension is missing from php -m — how do I tell whether it is actually installed?
php -m lists what this particular CLI binary has loaded, so it answers "not loaded" rather than "not installed" — a present-but-disabled extension is a common state. If it is absent there, check php -i, which reports the extension_dir path and the ini files in play; php --ini shows the search path and precedence directly. Only when no extension file exists in that directory do you need pecl install. If it installs but still does not appear, it has not been enabled in an ini file, and you should enable it and re-check.
Can the php -S built-in server be used in production?
No. php -S is a single-process development server whose purpose is to let you run a site locally without installing Nginx or Apache; it handles one request at a time and has no concurrency, timeouts or access control. To set the document root use php -S localhost:8000 -t public/ and keep the front-controller entry point inside public/, so your local layout matches production. Serving real traffic still belongs to Nginx with PHP-FPM or an equivalent concurrent handler.
Official References
Each command links to its official documentation below, so you can verify the latest usage and read deeper.
Maintained by LaoHand
Publicly updated on Jul 21, 2026, continuously proofread against official docs.
Contact Us
Wrong command or description? Send us corrections, business inquiries or product feedback by email.
Contact Us