Validation

How to validate incoming request data in Laravel using the validate method and form request classes.

What is validation?

Validation is the process of verifying that data submitted by the user meets the format and rules your application expects. Laravel provides a simple, expressive validation system built into the request object, with no third-party packages required.

Validating in a controller

Using $request->validate()

The most straightforward way to validate incoming data is to call $request->validate() inside a controller method. If validation fails, Laravel automatically redirects the user back to the previous page and stores the error messages in the session.

First, define your routes:

use App\Http\Controllers\PostController;

Route::get('/post/create', [PostController::class, 'create']);
Route::post('/post', [PostController::class, 'store']);

Then write the controller:

<?php

namespace App\Http\Controllers;

use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\View\View;

class PostController extends Controller
{
    public function create(): View
    {
        return view('post.create');
    }

    public function store(Request $request): RedirectResponse
    {
        $validated = $request->validate([
            'title' => 'required|string|max:255',
            'body'  => 'required|string',
            'email' => 'required|email',
        ]);

        // Save the post using validated data...

        return redirect('/posts');
    }
}

Pass an array to validate where each key is a field name and each value is the validation rules for that field. You can express rules either as a pipe-delimited string or as an array:

// Pipe-delimited
'title' => 'required|string|max:255',

// Array form
'title' => ['required', 'string', 'max:255'],

Common validation rules

Rule	Description
required	The field must be present and non-empty
string	The field must be a string
email	The field must be a valid email address
min:value	The string length or numeric value must be at least the given value
max:value	The string length or numeric value must not exceed the given value
unique:table	The value must be unique in the given database table
nullable	The field may be null
integer	The field must be an integer
boolean	The field must be true, false, 1, or 0
date	The field must be a valid date
confirmed	The field must match a corresponding field_confirmation field

For the full list of available validation rules, see the official documentation.

Using validated data

The validate method returns only the data that passed validation. Use this array directly — it contains nothing more than what you explicitly declared:

$validated = $request->validate([
    'title' => 'required|string|max:255',
    'body'  => 'required|string',
]);

// $validated is ['title' => '...', 'body' => '...']
Post::create($validated);

Displaying errors in Blade

When validation fails, Laravel makes an $errors variable available in every view. The ShareErrorsFromSession middleware in the web middleware group handles this automatically.

Display all errors

@if ($errors->any())
    <ul>
        @foreach ($errors->all() as $error)
            <li>{{ $error }}</li>
        @endforeach
    </ul>
@endif

Display errors per field

Use the @error directive to show an inline error message for a specific field:

<label for="title">Title</label>

<input
    id="title"
    type="text"
    name="title"
    value="{{ old('title') }}"
    class="@error('title') is-invalid @enderror"
/>

@error('title')
    <div class="error-message">{{ $message }}</div>
@enderror

Use old('field') to repopulate form fields with the user’s previous input after a validation failure.

Form request classes

When to use them

When validation logic becomes complex, extract it into a dedicated “form request” class. A form request encapsulates both the validation rules and the authorization check for a request.

Creating a form request

Use the make:request Artisan command:

php artisan make:request StorePostRequest

This creates app/Http/Requests/StorePostRequest.php:

<?php

namespace App\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;

class StorePostRequest extends FormRequest
{
    /**
     * Determine if the user is authorized to make this request.
     */
    public function authorize(): bool
    {
        return true;
    }

    /**
     * Get the validation rules that apply to the request.
     *
     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
     */
    public function rules(): array
    {
        return [
            'title' => 'required|string|max:255',
            'body'  => 'required|string',
            'email' => 'required|email|unique:posts',
        ];
    }
}

The rules() method

Return your validation rules as an array, using the same format as $request->validate().

The authorize() method

Return true to allow the request, or false to automatically return a 403 response. You can check the authenticated user here. For tutorials, returning true is fine.

If authorize returns false, Laravel returns a 403 Forbidden response and the controller method is never called.

Using the form request in a controller

Type-hint the form request class on your controller method. Laravel validates and authorizes the request before your method is called, so you can skip writing any validation code inside the method:

use App\Http\Requests\StorePostRequest;

class PostController extends Controller
{
    public function store(StorePostRequest $request): RedirectResponse
    {
        // Execution only reaches here if validation passed

        $validated = $request->validated();

        Post::create($validated);

        return redirect('/posts');
    }
}

Call $request->validated() to retrieve only the data that passed validation.

Practical example: a post creation form

Here is the full flow — from displaying a form to validating and saving the data.

1. Define routes

   use App\Http\Controllers\PostController;
   
   Route::get('/posts/create', [PostController::class, 'create']);
   Route::post('/posts', [PostController::class, 'store']);
   
2. Create a form request

   php artisan make:request StorePostRequest
   

   public function rules(): array
   {
       return [
           'title' => 'required|string|max:255',
           'body'  => 'required|string',
       ];
   }
   
   public function authorize(): bool
   {
       return true;
   }
   
3. Implement the controller

   use App\Http\Requests\StorePostRequest;
   use App\Models\Post;
   
   class PostController extends Controller
   {
       public function create(): View
       {
           return view('posts.create');
       }
   
       public function store(StorePostRequest $request): RedirectResponse
       {
           Post::create($request->validated());
   
           return redirect('/posts');
       }
   }
   
4. Create the Blade template

   {{-- resources/views/posts/create.blade.php --}}
   
   <h1>New Post</h1>
   
   @if ($errors->any())
       <ul>
           @foreach ($errors->all() as $error)
               <li>{{ $error }}</li>
           @endforeach
       </ul>
   @endif
   
   <form method="POST" action="/posts">
       @csrf
   
       <div>
           <label for="title">Title</label>
           <input
               id="title"
               type="text"
               name="title"
               value="{{ old('title') }}"
           />
           @error('title')
               <span>{{ $message }}</span>
           @enderror
       </div>
   
       <div>
           <label for="body">Body</label>
           <textarea id="body" name="body">{{ old('body') }}</textarea>
           @error('body')
               <span>{{ $message }}</span>
           @enderror
       </div>
   
       <button type="submit">Publish</button>
   </form>
   

Always include the @csrf directive in your Blade forms. Without it, Laravel returns a 419 error.

Next steps

Controllers

Review how to organize request handling logic in controller classes.