- Does pirasterize/sonata-form-builder work with Laravel?
- No. Despite often being catalogued alongside Laravel/PHP packages, this is a Symfony bundle built for the Sonata Project ecosystem and depends on SonataAdminBundle plus Doctrine ORM. It will not install or function as a Laravel package, and its admin UI, persistence schema and rendering layer all assume Sonata abstractions. For Laravel projects, reject it and evaluate Laravel-native options such as Filament form builders or a schema-driven form package paired with your own persistence layer.
- How do I install and register Sonata Form Builder in a Symfony application?
- Install it with Composer, then register the bundle in your Symfony bundle configuration and wire up the Sonata Admin classes it ships with. You will also need to inherit the package's Doctrine entity schema and run migrations so form definitions can be stored. Expect to read the source rather than rely on documentation, since the package appears to ship with limited setup guidance. Because the last release dates to February 2023, verify Composer constraints against your PHP and Symfony versions before design work.
- Which Symfony and PHP versions does this package support?
- This is not clearly documented, and the 2023-02-17 release date suggests Symfony 5/6-era constraints. Compatibility with a current Symfony LTS and PHP 8.2+ is unverified and should be treated as the primary feasibility gate before adopting it. Run a short spike in an isolated branch: install it, check composer why-not against your platform, and run composer audit to catch stale transitive dependencies. Treat every Symfony or Doctrine upgrade as a planned integration task rather than a routine update.
- Is Sonata Admin a hard dependency or can I use it standalone?
- Sonata Admin is effectively a hard dependency. The builder UI, the Doctrine-backed management layer and the form rendering workflow are all designed to sit inside SonataAdminBundle, so using it outside that ecosystem would mean forking significant parts of the package. If your application is not Symfony with Sonata Admin already installed, the architecture fit is zero regardless of feature quality.
- How are form definitions stored, and can I use a different persistence layer?
- Form definitions and their field structure are persisted as Doctrine ORM entities, which is why the package expects Doctrine as part of the stack. Using another persistence layer would require modifying or replacing the entity mapping. Plan on inheriting the package's schema, running its migrations, and confirming the exact table layout before you build anything load-bearing on top of it.
- How do I render a dynamically built form in a Twig template?
- The package is described as rendering dynamic forms in your Symfony templates from stored definitions, so rendering typically goes through a controller or service that reads the definition and builds the form at runtime. Confirm in the source whether forms are rendered dynamically at runtime or compiled into generated form classes, because the security and performance implications differ sharply. Also check how field type templates are resolved and whether you can override them cleanly.
- Are form submissions persisted to the database?
- Yes, the package advertises Doctrine-backed form definitions and submissions, so submitted data is stored under its own schema rather than only handled in memory. Verify the submission schema, retention expectations, and whether you can query and export the data later without going through package entities. Persisted definitions plus stored submissions are the main lock-in risk, so wrap access in your own services if you adopt it.
- Does it support file uploads, conditional logic and server-side validation?
- Field types are described as extensible, but support for file uploads, conditional logic and validation rules is not documented in the available material. Treat all three as unverified until you inspect the source and test them directly. Regardless of what the builder offers in the UI, enforce validation and authorization server-side in your own code, since client-configured rules are not a security boundary.
- Is it safe to render user-defined form structures, or is stored XSS a concern?
- Stored XSS is a realistic concern for any form builder: a user with admin access defines field labels, options and templates that are later rendered to other users. Unsafe field-type resolution and unbounded schema input are the other obvious risks, and there is no evident security policy or disclosure process for this package. Sanitize and escape rendered output, whitelist the field types that may be resolved, cap schema size, and treat the overall risk as elevated.
- Is Sonata Form Builder actively maintained, and what should I use instead?
- The project has roughly 18 stars, a personal vendor namespace and no release since February 2023, so abandonment risk is high and there is no stated commitment to security patches. If you need it, fork it under your own namespace and place it behind an internal adapter interface so storage and rendering can be swapped later. Under Laravel, evaluate Filament form builders or a headless JavaScript form builder with persistence you control; under Symfony, budget for maintaining your own fork.