Page 16 - Symfony

The Symfony Form component is one of the most powerful and most complex in the ecosystem. Anyone who only uses built-in types gives away half its potential. Custom Form Types encapsulate reusability, Data Transformers bridge the gap between form input and domain objects, without boilerplate in every single form.

Running shell commands from PHP with exec() or shell_exec() is dangerous, hard to test and gives you no control over timeouts or output streaming. The Symfony Process Component solves all of these problems with a clear API for shell processes that is mockable in tests and reliable in production.

Combining Symfony with Inertia.js means writing controllers largely the same classic, Twig-like way, except that at the end a React component name with props is returned instead of HTML, making the entire frontend feel like a single page application, without a separate REST or GraphQL API ever coming into existence.

Controllers that write, read, transform and return data all at once are the normal state in many Symfony projects. CQRS consistently separates these responsibilities: commands change state, queries read data. The result is more maintainable, testable and scalable code.

PHPStan is the most powerful static analyzer for PHP, but in Symfony projects teams quickly hit limits: magic methods in repositories, Doctrine column types that differ from PHP types, container parameters without types and complex generic annotations. This article shows how to systematically bring PHPStan in Symfony to level 9.

A webhook endpoint is, by definition, publicly reachable and accepts data from an external service without the ability to apply the application's usual login mechanism. Without cryptographic signature verification, anyone who knows the URL can in principle inject arbitrary payloads and trigger business actions such as a payment confirmation or an order status change. This article shows how to build a dedicated webhook controller in Symfony, how to verify an HMAC signature safely against timing attacks using hash_hmac and hash_equals, when the built-in Symfony webhook component fits, and how to process repeated deliveries of the same event idempotently.

Every Symfony request needs a ready dependency injection container, and how that container gets built, compiled and cached decides a significant share of boot time. Container warmup with cache:warmup moves the expensive compilation out of the request and into the deployment phase.

API Platform automatically generates queries and mutations from every resource, but as soon as an action combines several resources or real time updates are needed, you need a custom GraphQL resolver. This article shows how query resolvers, mutation resolvers with dedicated input classes, and Mercure based subscriptions work together in API Platform.

Manually extracting JSON data from request arrays and mapping it into PHP objects is error-prone and does not scale. The Symfony Serializer normalizes objects into JSON and denormalizes JSON into type-safe PHP DTOs, with serialization groups, custom normalizers and constructor promotion.

Two teams that both need end-to-end tests for their Symfony application can arrive at completely different, equally correct answers when picking a tool. Panther writes browser tests as ordinary PHPUnit code with a real browser running behind it, which mainly benefits developers who already think in PHP. Behat describes the same scenarios in readable Gherkin syntax that a product owner without any programming background can understand, and even help write. This article compares both tools along the questions that actually decide things in practice: readability, developer speed, maintenance overhead, and whether you really only need one of the two.