Validation

What is validation?

Validation is the process of verifying that data submitted by the user meets the format and rules your application expects. Laravel provides a simple, expressive validation system built into the request object, with no third-party packages required.

Validating in a controller

Using `$request->validate()`

The most straightforward way to validate incoming data is to call $request->validate() inside a controller method. If validation fails, Laravel automatically redirects the user back to the previous page and stores the error messages in the session. First, define your routes:

use App\Http\Controllers\PostController;

Route::get('/post/create', [PostController::class, 'create']);
Route::post('/post', [PostController::class, 'store']);

Then write the controller:

<?php

namespace App\Http\Controllers;

use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\View\View;

class PostController extends Controller
{
    public function create(): View
    {
        return view('post.create');
    }

    public function store(Request $request): RedirectResponse
    {
        $validated = $request->validate([
            'title' => 'required|string|max:255',
            'body'  => 'required|string',
            'email' => 'required|email',
        ]);

        // Save the post using validated data...

        return redirect('/posts');
    }
}

Pass an array to validate where each key is a field name and each value is the validation rules for that field. You can express rules either as a pipe-delimited string or as an array:

// Pipe-delimited
'title' => 'required|string|max:255',

// Array form
'title' => ['required', 'string', 'max:255'],

Common validation rules

Rule	Description
`required`	The field must be present and non-empty
`string`	The field must be a string
`email`	The field must be a valid email address
`min:value`	The string length or numeric value must be at least the given value
`max:value`	The string length or numeric value must not exceed the given value
`unique:table`	The value must be unique in the given database table
`nullable`	The field may be `null`
`integer`	The field must be an integer
`boolean`	The field must be `true`, `false`, `1`, or `0`
`date`	The field must be a valid date
`confirmed`	The field must match a corresponding `field_confirmation` field
`array_keys:key1,key2,...`	The array’s keys must all be included in the given list

Advanced email validation

The email rule accepts parameters that let you choose how the address is validated:

'email' => ['email:rfc,dns']

The rfc validator checks the address against supported RFCs, while dns ensures that the address’s domain has a valid MX record. The dns validator performs a real DNS lookup, but does not determine whether an individual mailbox exists. You can also use the fluent rule builder:

use Illuminate\Validation\Rule;

$request->validate([
    'email' => [
        'required',
        Rule::email()
            ->rfcCompliant(strict: false)
            ->validateMxRecord()
            ->preventSpoofing(),
    ],
]);

To keep tests from relying on live DNS lookups, use Validator::fakeDnsLookups. This fakes the dns lookup while other requested validations, such as rfc, continue to run:

use Illuminate\Support\Facades\Validator;

Validator::fakeDnsLookups();

The dns and spoof validators require the PHP intl extension.

Validating array keys

The array_keys rule validates that the value under validation is a PHP array whose keys are all included in the given list. At least one key must be provided:

'user' => ['array_keys:name,username'],

For a fluent rule object, use the Rule::arrayKeys method:

use Illuminate\Validation\Rule;

'user' => [Rule::arrayKeys('name', 'username')],

For the full list of available validation rules, see the official documentation.

Using validated data

The validate method returns only the data that passed validation. Use this array directly — it contains nothing more than what you explicitly declared:

$validated = $request->validate([
    'title' => 'required|string|max:255',
    'body'  => 'required|string',
]);

// $validated is ['title' => '...', 'body' => '...']
Post::create($validated);

Displaying errors in Blade

When validation fails, Laravel makes an $errors variable available in every view. The ShareErrorsFromSession middleware in the web middleware group handles this automatically.

Display all errors

@if ($errors->any())
    <ul>
        @foreach ($errors->all() as $error)
            <li>{{ $error }}</li>
        @endforeach
    </ul>
@endif

Display errors per field

Use the @error directive to show an inline error message for a specific field:

<label for="title">Title</label>

<input
    id="title"
    type="text"
    name="title"
    value="{{ old('title') }}"
    class="@error('title') is-invalid @enderror"
/>

@error('title')
    <div class="error-message">{{ $message }}</div>
@enderror

Use old('field') to repopulate form fields with the user’s previous input after a validation failure.

Form request classes

When to use them

When validation logic becomes complex, extract it into a dedicated “form request” class. A form request encapsulates both the validation rules and the authorization check for a request.

Creating a form request

Use the make:request Artisan command:

php artisan make:request StorePostRequest

This creates app/Http/Requests/StorePostRequest.php:

<?php

namespace App\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;

class StorePostRequest extends FormRequest
{
    /**
     * Determine if the user is authorized to make this request.
     */
    public function authorize(): bool
    {
        return true;
    }

    /**
     * Get the validation rules that apply to the request.
     *
     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
     */
    public function rules(): array
    {
        return [
            'title' => 'required|string|max:255',
            'body'  => 'required|string',
            'email' => 'required|email|unique:posts',
        ];
    }
}

The `rules()` method

Return your validation rules as an array, using the same format as $request->validate().

The `authorize()` method

Return true to allow the request, or false to automatically return a 403 response. You can check the authenticated user here. For tutorials, returning true is fine.

If authorize returns false, Laravel returns a 403 Forbidden response and the controller method is never called.

Using the form request in a controller

Type-hint the form request class on your controller method. Laravel validates and authorizes the request before your method is called, so you can skip writing any validation code inside the method:

use App\Http\Requests\StorePostRequest;

class PostController extends Controller
{
    public function store(StorePostRequest $request): RedirectResponse
    {
        // Execution only reaches here if validation passed

        $validated = $request->validated();

        Post::create($validated);

        return redirect('/posts');
    }
}

Call $request->validated() to retrieve only the data that passed validation.

Specify password complexity and length

The Password rule object lets you define password complexity and minimum and maximum lengths together.

use Illuminate\Validation\Rules\Password;

Password::min(16)
    ->max(256)
    ->letters()
    ->mixedCase()
    ->numbers()
    ->symbols();

min() sets the minimum length, while max() sets the maximum length. Use max() to make the accepted upper bound explicit when integrating with storage or external services.

Practical example: a post creation form

Here is the full flow — from displaying a form to validating and saving the data.

Define routes

use App\Http\Controllers\PostController;

Route::get('/posts/create', [PostController::class, 'create']);
Route::post('/posts', [PostController::class, 'store']);

Create a form request

php artisan make:request StorePostRequest

public function rules(): array
{
    return [
        'title' => 'required|string|max:255',
        'body'  => 'required|string',
    ];
}

public function authorize(): bool
{
    return true;
}

Implement the controller

use App\Http\Requests\StorePostRequest;
use App\Models\Post;

class PostController extends Controller
{
    public function create(): View
    {
        return view('posts.create');
    }

    public function store(StorePostRequest $request): RedirectResponse
    {
        Post::create($request->validated());

        return redirect('/posts');
    }
}

Create the Blade template

{{-- resources/views/posts/create.blade.php --}}

<h1>New Post</h1>

@if ($errors->any())
    <ul>
        @foreach ($errors->all() as $error)
            <li>{{ $error }}</li>
        @endforeach
    </ul>
@endif

<form method="POST" action="/posts">
    @csrf

    <div>
        <label for="title">Title</label>
        <input
            id="title"
            type="text"
            name="title"
            value="{{ old('title') }}"
        />
        @error('title')
            <span>{{ $message }}</span>
        @enderror
    </div>

    <div>
        <label for="body">Body</label>
        <textarea id="body" name="body">{{ old('body') }}</textarea>
        @error('body')
            <span>{{ $message }}</span>
        @enderror
    </div>

    <button type="submit">Publish</button>
</form>

Always include the @csrf directive in your Blade forms. Without it, Laravel returns a 419 error.

Next steps

Controllers

Review how to organize request handling logic in controller classes.

Getting Started

Basics

Request Handling

Database

Authentication

Helpers and External Communication

Testing and Deployment

AI Development Support

What is validation?

Validating in a controller

Using `$request->validate()`

Common validation rules

Advanced email validation

Validating array keys

Using validated data

Displaying errors in Blade

Display all errors

Display errors per field

Form request classes

When to use them

Creating a form request

The `rules()` method

The `authorize()` method

Using the form request in a controller

Specify password complexity and length

Practical example: a post creation form

Next steps

Controllers

​What is validation?

​Validating in a controller

​Using $request->validate()

​Common validation rules

​Advanced email validation

​Validating array keys

​Using validated data

​Displaying errors in Blade

​Display all errors

​Display errors per field

​Form request classes

​When to use them

​Creating a form request

​The rules() method

​The authorize() method

​Using the form request in a controller

​Specify password complexity and length

​Practical example: a post creation form

​Next steps

Controllers

What is validation?

Validating in a controller

Using `$request->validate()`

Common validation rules

Advanced email validation

Validating array keys

Using validated data

Displaying errors in Blade

Display all errors

Display errors per field

Form request classes

When to use them

Creating a form request

The `rules()` method

The `authorize()` method

Using the form request in a controller

Specify password complexity and length

Practical example: a post creation form

Next steps