Symfony 7 Cheat Sheet (2025)

What this page covers

  • Setup and console

    Creating a project, the Symfony CLI, and the console commands worth memorising.

  • Structure and dependencies

    Where things live in a Symfony 7 project, and managing packages with Composer and Flex.

  • Doctrine and the database

    Entities, migrations and the commands around them.

  • Routing and controllers

    Attribute routing, controller shape, and generating URLs.

  • Forms, Twig and sessions

    Form types, template syntax, and flash messages.

  • Security, testing and profiling

    Current security practice, what is new in 7.x, running tests in CI, and reading the profiler.

Project Setup

Working on Symfony 2.x? The older Symfony cheat sheet covers the app/console commands.

  • Install Symfony CLI globally:
curl -sS https://get.symfony.com/cli/installer | bash
  • Create a new project using Composer:
symfony new my_project --webapp
  • Requirements: PHP 8.2+ is mandatory for all modern Symfony 7 features.

Console Usage

  • All console commands use:
bin/console <command>
  • Example: Clear production cache
bin/console cache:clear --env=prod

Directory & Structure

  • Your code lives in****src/, not in custom bundles.

  • Use PHP namespaces to organize, not bundles (Bundles are for third-party packages).

  • Configurations:

Environment variables in.env and.env.local for dev.

  • Service and app config: config/services.yaml, constants when applicable.

Composer & Dependency Management

  • Update dependencies regularly to get security patches:
composer update
  • Symfony Flex automates package configuration recommendations and recipes.

Doctrine & Database

  • Generate entity from an existing database:
php bin/console doctrine:mapping:import "App\Entity" annotation --path=src/Entity
php bin/console make:entity --regenerate App
  • Migrations:
php bin/console make:migration
php bin/console doctrine:migrations:migrate
  • Recommended: Use PHP attributes for mapping (annotations), YAML/XML is still supported but discouraged.

Routing

  • List all registered routes:
bin/console debug:router
  • Modern route definitions use PHP attributes:
#[Route('/blog', name: 'blog_list')]

Controllers & Routing

  • Redirect in controllers:
return $this->redirectToRoute('dashboard');
  • Get route, request, and current user in modern Symfony:
$routeName = $request->attributes->get('_route');
$user = $this->getUser();
$userId = $user?->getId();

Forms

  • Form submission check:
if ($form->isSubmitted() && $form->isValid()) { ... }
  • Accessing unmapped fields:
$unmapped = $form->get('unmapped_field')->getData();
  • Persist many-to-many or related entities:
$entityManager->persist($entity);
$entityManager->flush();

Twig

  • Twig now supports strict variable typing and enhancements.

  • Twig templates use.twig.html by default.

  • Twig Extension attributes simplify extensions and are lazy-loaded.

Sessions & Flash Messages

  • Use FlashBag for temporary messages:
{% for message in app.flashes('notice') %}<div class="flash-notice">{{ message }}</div>{% endfor %}Assets
  • Pre-compress assets for performance:

bin/console assets:install --symlink bin/console asset:precompress

Use AssetMapper for modern JS/CSS, no front-end bundler needed.

Security Best Practices (2025)

  • Enable HTTPS and set secure cookie flags.

  • Enforce Multi-Factor Authentication and strong password policies.

  • Validate/sanitize all input and output.

  • Keep Symfony and all libraries regularly updated.

  • Use new security features: detailed voter decisions, OIDC integration, safer session handling.

New Features in Symfony 7.x

  • Native PHP types for properties/methods everywhere.

  • Attributes for routes, service definitions, and event subscribers.

  • Scheduler: easily set up cron-like jobs within your app.

  • HTML Sanitizer: built-in, standards-compliant sanitization on output.

  • ObjectMapper: map objects/DTOs simply; removes boilerplate.

  • Server-sent Events streaming made easy.

  • Compound Rate Limiter & advanced environment configuration.

Testing & CI

  • Rely on PHPUnit for automated testing (required for most recipes).

  • Emphasize TDD, leverage CI tools like GitHub Actions, GitLab CI.

  • Integrate Docker for dev/prod parity and reliable testing.

  • Run static analysis (Psalm, PHPStan) in CI to catch errors early.

Debugging & Profiler

  • Use Symfony Profiler (enabled by default in dev) for request tracing.

  • Debug security voters with detailed messages in the profiler/logs.

Quick Common Commands

Description Command
Clear cache bin/console cache:clear --env=prod
List routes bin/console debug:router
Run migration bin/console doctrine:migrations:migrate
Start web server symfony serve

Useful Links

Note: This cheat sheet is fully updated for Symfony 7 (2025), new features, modern security, testing/CI practices, and recommended code structure. For additional details or clarification, always refer to the official Symfony documentation.