If you're heading into a PHP interview, you can bet your bottom dollar that Composer and autoloading will come up. Interviewers love these topics because they separate the people who just "copy-paste from a tutorial" from the engineers who actually understand how the PHP ecosystem fits together. I've sat on both sides of the table, and the questions usually center around the why, not just the how.

What is the actual difference between composer install and composer update?

This is the classic "gotcha" question. If you say "they both install packages," you've failed. The difference is all about the composer.lock file.

When you run composer install, Composer looks for a composer.lock file. If it exists, it installs the exact versions listed there. It doesn't matter if a newer version of a library is available; it wants your environment to be identical to everyone else's on the team. If there is no lock file, it behaves like an update.

composer update, on the other hand, ignores the lock file. It looks at your composer.json, finds the latest versions that fit your version constraints (like ^2.0), installs them, and then updates the composer.lock file to reflect those new versions. I always tell my juniors: never run update on a production server. You're essentially rolling the dice on whether a dependency update will break your site in the middle of the day.

How does PSR-4 autoloading actually work under the hood?

Interviewers want to know if you understand that "magic" isn't actually magic—it's just a mapping system. PSR-4 is a standard that maps a namespace prefix to a specific directory.

Let's say you have this in your composer.json:

{
    "autoload": {
        "psr-4": {
            "App\\": "src/"
        }
    }
}

When you try to instantiate a class like new App\Services\PaymentGateway(), PHP realizes it doesn't know where that class is. Instead of crashing, it asks the registered autoloader (Composer's). Composer looks at that map and says, "Okay, App\ means the src/ folder." It then converts the rest of the namespace Services\PaymentGateway into a file path: src/Services/PaymentGateway.php. If the file exists, it's included. If not, it throws a Fatal Error.

Why do we have to include vendor/autoload.php in every entry point?

I've seen a lot of developers just do this because "that's how it's done," but the technical reason is the SPL (Standard PHP Library) autoloader. PHP has a built-in function called spl_autoload_register() that allows you to define a custom function to be called whenever a class is not found.

The vendor/autoload.php file is essentially a wrapper that calls spl_autoload_register() and passes in Composer's complex logic for finding files. If you forget to include it, PHP has no instructions on where to find your classes or your dependencies. You'd be forced to go back to the dark ages of manually writing require_once 'src/Services/PaymentGateway.php'; at the top of every single file, which is a maintenance nightmare in any project larger than a few scripts.

What happens if I change a namespace or move a file?

This is where people get stuck. If you move src/Services/PaymentGateway.php to src/Infrastructure/Payments/PaymentGateway.php and update the namespace inside the file, you might find that PHP still can't find it—or worse, it's acting weird.

While PSR-4 is dynamic, Composer often optimizes the autoloader for production using composer dump-autoload -o. This creates a static "class map" (a giant associative array) to avoid hitting the file system repeatedly. If you've optimized your autoloader, any move or name change requires you to run composer dump-autoload again to refresh that map. I've spent hours debugging "Class not found" errors only to realize I forgot to refresh the class map after a refactor.

📋 Practical Task

Exercise: Fixing a Broken PSR-4 Namespace Mapping

You have inherited a legacy project where a developer tried to reorganize the folders but didn't update the configuration correctly. The application is throwing a Fatal error: Class "App\Billing\InvoiceGenerator" not found.

Current Project Structure:

/project
  /src
    /Billing
      InvoiceGenerator.php
  composer.json
  index.php

The contents of composer.json:

{
    "autoload": {
        "psr-4": {
            "Project\\": "src/"
        }
    }
}

The contents of src/Billing/InvoiceGenerator.php:

<?php
namespace App\Billing;

class InvoiceGenerator {
    public function generate() {
        return "Invoice generated!";
    }
}

The contents of index.php:

<?php
require 'vendor/autoload.php';

$invoice = new App\Billing\InvoiceGenerator();
echo $invoice->generate();

Your Task: Identify the mismatch between the composer.json mapping and the actual namespace used in the class file. Fix the composer.json file so that the App\ namespace correctly maps to the src/ directory, and explain which Composer command you must run in the terminal to apply this change to the autoloader.