PHP Dependency Injection: Containers and Factories

Supply dependencies through constructors or factories so security-sensitive services can be tested independently.

The examples introduce the underlying control before showing a verification and an application-level safeguard.

What You Will Build

Supply dependencies through constructors or factories so security-sensitive services can be tested independently.

Prerequisites

Use PHP 8.4 or newer, HTTPS for all authentication operations, and an application session or database where required. Example configuration values are placeholders, never production secrets.

Example 1: Basic Operation

Inject a time source rather than calling time() deep inside business logic.

<?php
interface Clock { public function now(): int; }
final class SystemClock implements Clock { public function now(): int { return time(); } }
final class ExpiryService { public function __construct(private Clock $clock) {} public function expired(int $at): bool { return $this->clock->now() >= $at; } }
var_dump((new ExpiryService(new SystemClock()))->expired(0));

Example 2: A Different Use Case

Substitute a fake dependency to test a service without a network.

<?php
interface Sender { public function send(string $message): void; }
final class NullSender implements Sender { public array $messages=[]; public function send(string $message): void { $this->messages[]=$message; } }
final class Notifier { public function __construct(private Sender $sender) {} public function alert(): void {$this->sender->send('alert');} }
$fake = new NullSender(); (new Notifier($fake))->alert();
var_dump($fake->messages);

Practical Example: Checking the Result

Use a small factory to centralize object construction when a container is unnecessary.

<?php
final class ServiceFactory {
    public static function makeClock(): DateTimeImmutable { return new DateTimeImmutable('now', new DateTimeZone('UTC')); }
}
echo ServiceFactory::makeClock()->getTimezone()->getName();

Important Behavior and Edge Cases

Do not use a global service locator or instantiate a database in every controller; prefer explicit interfaces and boundaries.

Enforce controls on the server, test denial paths and do not assume that a snippet alone implements an entire production workflow.

Comparison with Related Functions

Common Beginner Mistakes

Key Takeaways

• Supply dependencies through constructors or factories so security-sensitive services can be tested independently.
• Do not use a global service locator or instantiate a database in every controller; prefer explicit interfaces and boundaries.
• Factories construct object graphs; a dependency-injection container may automate resolution but is optional.

Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.