Symfony ExpressionLanguage

The ExpressionLanguage component provides a small, self-contained engine for parsing and evaluating expression strings — one-liners like user.getAge() > 18 and user.isActive() — without giving callers the security risk of PHP’s eval(). It exposes a lexer, parser, and compiler pipeline that turns expression strings into an AST, which can then be evaluated directly against a context of variables or compiled down to raw PHP for repeated, high-performance evaluation.

It is used throughout the Symfony ecosystem wherever configuration needs to express conditional logic declaratively — security voters, routing conditions, service container expressions, and validation constraints — and is equally usable standalone in any PHP project that needs a safe, cacheable expression evaluator.

What You Get

• An ExpressionLanguage class exposing evaluate() for immediate evaluation and compile() for generating cacheable PHP code
• A lexer/parser/compiler pipeline (Lexer, Parser, Compiler, Node/) producing an inspectable AST
• Custom function registration via ExpressionFunction and ExpressionFunctionProviderInterface
• Optional caching of parsed expressions via a PSR-6 cache adapter for high-throughput evaluation
• Serialized/parsed expression support so expressions can be precompiled and reused without re-parsing

Common Use Cases

• Writing conditional access-control rules in Symfony Security voters (is_granted("ROLE_ADMIN") or user.isOwner(post))
• Defining route-matching conditions in Symfony routing configuration without custom PHP matcher classes
• Evaluating dynamic validation constraints (Symfony Validator’s Expression constraint) based on other object properties
• Building a safe, sandboxed rules engine for end-user-configurable business logic (pricing rules, feature flags) outside Symfony

Under The Hood

Architecture Lexer.php tokenizes an expression string, Parser.php builds a tree of Node/ objects representing the AST, and Compiler.php walks that tree to either evaluate it directly against a variable context or emit equivalent PHP source code; ExpressionLanguage.php is the public facade tying lexing/parsing/compiling/caching together behind evaluate() and compile().

Tech Stack Minimal pure-PHP component (PHP 8.4+) depending only on symfony/cache (for optional parsed-expression caching) and symfony/service-contracts; no external parser-generator or third-party dependency is used — the lexer and parser are hand-written.

Code Quality The Tests/ directory includes dedicated suites for the Lexer, Parser, Compiler, and each Node type, plus fixture-driven expression-evaluation tests, giving good coverage of a component where subtle parsing bugs would be high-impact given its use in security rules.

API Design The two-method public surface (evaluate(), compile()) plus a simple ExpressionFunction registration API keeps the learning curve low for basic use; understanding the AST/Node internals for custom function providers or static analysis requires more effort but is optional for typical usage.