Home » Php » curl – Run composer with a PHP script in browser

curl – Run composer with a PHP script in browser

Posted by: admin April 23, 2020 Leave a comment


Wondering if it’s possible to execute composer from the browser with a little PHP wrapper as I don’t have access to shell access to the server.

Not sure if you can do this with cURL?

How to&Answers:

Yes you can run Composer with a little PHP wrapper. All of the Composer source code is available in the Phar file, so it can be extracted and then you can run it after setting up an InputInterface to replace Composer expecting the commands to be passed in via the command line.

If you setup your directory structure like this:


Put the code below into composerExtractor.php and then run it from a web-browser, Composer should download all the libraries into:


As well as generating the class-loader files in that directory as well.



define('EXTRACT_DIRECTORY', "../var/extractedComposer");

if (file_exists(EXTRACT_DIRECTORY.'/vendor/autoload.php') == true) {
    echo "Extracted autoload already exists. Skipping phar extraction as presumably it's already extracted.";
    $composerPhar = new Phar("Composer.phar");
    //php.ini setting phar.readonly must be set to 0

//This requires the phar to have been extracted successfully.
require_once (EXTRACT_DIRECTORY.'/vendor/autoload.php');

//Use the Composer classes
use Composer\Console\Application;
use Composer\Command\UpdateCommand;
use Symfony\Component\Console\Input\ArrayInput;

// change out of the webroot so that the vendors file is not created in
// a place that will be visible to the intahwebz

//Create the commands
$input = new ArrayInput(array('command' => 'update'));

//Create the application and run it with the commands
$application = new Application();


Although this is possible, it’s not a fantastic idea but may be necessary if you can’t use a host that gives you ssh access.

I’d strongly recommend at least getting a static IP address for yourself or your office and then restricting access to just your own IP, as well as probably deleting this script after it’s run on the server to prevent it being accidentally run again.


An alternative to Danack’s solution, is to include "composer/composer" as a
dependency in your composer.json, and just use it’s API, instead of extracting
the contents from composer.phar.


"require-dev": {
  "composer/composer": "dev-master",

Run composer install manually, so you’ll be able to require it on the following script:


require 'vendor/autoload.php'; // require composer dependencies

use Composer\Console\Application;
use Symfony\Component\Console\Input\ArrayInput;

// Composer\Factory::getHomeDir() method 
// needs COMPOSER_HOME environment variable set
putenv('COMPOSER_HOME=' . __DIR__ . '/vendor/bin/composer');

// call `composer install` command programmatically
$input = new ArrayInput(array('command' => 'install'));
$application = new Application();
$application->setAutoExit(false); // prevent `$application->run` method from exitting the script

echo "Done.";

When you access the script from your browser, the command should run as expected.


I think it would be a better idea to actually run Composer on the machine that hosts your source code just before deployment.

You probably checkout your code from some kind of version control before you upload it to your host (or even just have it on your hard drive without). That machine should get Composer installed and execute composer install right before upload. You don’t need to expose the production machine to download all the stuff.


I’ve successfully used this function. Keep in mind, that ‘composer-source’ is a directory with content extracted from composer.phar archive.

use Symfony\Component\Console\Application;
use Symfony\Component\Console\Input\ArrayInput;
use Symfony\Component\Console\Output\StreamOutput;

function composerInstall() {
    //create composer.json with some content
    require_once 'composer-source/vendor/autoload.php';
    putenv('COMPOSER_HOME=' . __DIR__ . '/composer-source/bin/composer');
    $stream = fopen('php://temp', 'w+');
    $output = new StreamOutput($stream);
    $application = new Application();
    $code = $application->run(new ArrayInput(array('command' => 'install')), $output);
    return stream_get_contents($stream);

By the way, you can extract composer.phar on this site: http://unphar.com/


Similar to Endel’s answer, but I needed to capture the output from composer show --direct in an array, so I extracted some code from the ShowCommand file in the composer repository and made a composer-wrapper library, with which I can do:

$cw = new \shadiakiki1986\ComposerWrapper();
$packages = $cw->showDirect();

and get an associative array like ['composer/composer'=>'']


I don’t know if this is always done on installation, but I installed composer via Ubuntu’s package, and it included “Composer” in the “/use/share/php” directory (which is in the include path).

Therefore, by simply having installed composer on the machine at all, I am able to do:

require_once 'Composer/autoload.php';
$application = new Composer\Console\Application();