Laravel Validation¶

Laravel provides built-in request validation with 90+ rules, automatic redirect-back on failure, and flash error messages. Validation can be inline in controllers or extracted to Form Request classes. Validated data is safe for laravel eloquent orm operations. Errors are displayed in laravel blade templates via $errors and @error.

Key Facts¶

$request->validate([...]) returns validated data array; auto-redirects back with errors on failure
Validation rules as string ('required|email|max:255') or array (['required', 'email', 'max:255'])
$errors variable is always available in Blade templates (even when empty)
old('field') retrieves previous input after validation failure
Form Request classes: separate validation logic into dedicated Request subclass
php artisan make:request StorePostRequest generates a Form Request class
Custom error messages via third parameter or Form Request messages() method
Localization: validation messages in lang/en/validation.php
unique rule: 'email' => 'unique:users,email' checks against database
sometimes rule: only validate if field is present in request

Patterns¶

Inline validation in controller¶

<?php
public function store(Request $request)
{
    $validated = $request->validate([
        'title'       => 'required|string|max:255',
        'slug'        => 'required|string|unique:posts,slug',
        'body'        => 'required|string',
        'category_id' => 'required|exists:categories,id',
        'image'       => 'nullable|image|mimes:jpg,png,webp|max:2048',
        'tags'        => 'nullable|array',
        'tags.*'      => 'exists:tags,id',
    ]);

    Post::create($validated);
    return redirect()->route('posts.index')->with('success', 'Post created.');
}

// On validation failure: auto redirect back with $errors and old input

Form Request class¶

php artisan make:request StorePostRequest

<?php
namespace App\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;

class StorePostRequest extends FormRequest
{
    public function authorize(): bool
    {
        return true; // or check user permissions
    }

    public function rules(): array
    {
        return [
            'title'       => 'required|string|max:255',
            'slug'        => 'required|string|unique:posts,slug',
            'body'        => 'required|string',
            'category_id' => 'required|exists:categories,id',
        ];
    }

    public function messages(): array
    {
        return [
            'title.required'    => 'Post title is required.',
            'slug.unique'       => 'This URL slug is already taken.',
            'category_id.exists' => 'Selected category does not exist.',
        ];
    }
}

<?php
// Controller uses type-hinted Form Request
public function store(StorePostRequest $request)
{
    // Validation already passed at this point
    Post::create($request->validated());
    return redirect()->route('posts.index');
}

Common validation rules¶

<?php
$rules = [
    // String rules
    'name'     => 'required|string|min:2|max:100',
    'email'    => 'required|email',
    'slug'     => 'required|alpha_dash',      // letters, numbers, dashes, underscores
    'url'      => 'nullable|url',

    // Numeric rules
    'price'    => 'required|numeric|min:0',
    'quantity' => 'required|integer|between:1,100',

    // Date rules
    'start'    => 'required|date|after:today',
    'end'      => 'required|date|after:start',

    // File rules
    'avatar'   => 'nullable|image|mimes:jpg,png|max:2048',  // max 2MB
    'document' => 'nullable|file|mimes:pdf,doc|max:10240',

    // Database rules
    'email'    => 'required|unique:users,email',           // unique in table
    'email'    => 'required|unique:users,email,' . $user->id, // ignore current record
    'cat_id'   => 'required|exists:categories,id',         // must exist in table

    // Array rules
    'tags'     => 'nullable|array',
    'tags.*'   => 'integer|exists:tags,id',                // each element

    // Conditional rules
    'password' => 'required|confirmed|min:8',              // requires password_confirmation field
    'bio'      => 'sometimes|string|max:500',              // only validate if present
];

Update validation (unique except current)¶

<?php
// When updating, exclude current record from unique check
public function update(Request $request, Post $post)
{
    $validated = $request->validate([
        'title' => 'required|string|max:255',
        'slug'  => 'required|unique:posts,slug,' . $post->id,
        'body'  => 'required|string',
    ]);

    $post->update($validated);
    return redirect()->route('posts.index');
}

<?php
public function authenticate(Request $request)
{
    // For LOGIN: only validate format, NOT password strength
    // Revealing password requirements helps attackers
    $credentials = $request->validate([
        'email'    => ['required', 'email'],
        'password' => ['required'],  // NO min length, NO complexity rules
    ]);

    if (Auth::attempt($credentials)) {
        $request->session()->regenerate();
        return redirect()->intended('/admin');
    }

    // Generic error message - don't reveal which field was wrong
    return back()->with('error', 'Incorrect email or password.');
}

Gotchas¶

Symptom	Cause	Fix
`old()` shows nothing after error	Input missing `name` attribute	Add `name="field"` to HTML input
Validation passes for empty optional field	`nullable` rule allows null/empty	This is correct behavior; add `required` if field is mandatory
File validation accepts wrong type	Missing `mimes` rule or wrong mime type	Add `mimes:jpg,png,pdf` explicitly
`unique` fails on update (own record)	Current record ID not excluded	Use `unique:table,column,' . $model->id`
Revealing password requirements on login	Validating password rules on login form	Only use `required` for login; full rules for registration
Form Request `authorize()` returns false	Default is `false`	Set to `true` or add authorization logic
Array validation not working	Missing `.*` suffix for array elements	Use `'tags.*' => 'exists:tags,id'`