Form Requests & Validation

📝 Form Requests & Validation

Inline Validation

For a simple case, $request->validate() runs right inside a controller method — rules expressed as pipe-separated strings:

Copypublic function store(Request $request)
{
    $validated = $request->validate([
        'title' => 'required|string|max:255',
        'price' => 'required|numeric|min:0',
        'author_id' => 'required|exists:authors,id',
    ]);

    Book::create($validated);
    return redirect()->route('books.index');
}

A failed validation automatically redirects back to the previous page with the errors and old input flashed to the session — no manual if/else branch needed the way Django's is_valid() requires.

📋 FormRequest Classes

For anything beyond the simplest case, a dedicated request class keeps validation rules out of the controller entirely:

Copyphp artisan make:request StoreBookRequest

Copy// app/Http/Requests/StoreBookRequest.php
namespace App\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;

class StoreBookRequest extends FormRequest
{
    public function authorize(): bool
    {
        return true;  // or a real permission check
    }

    public function rules(): array
    {
        return [
            'title' => 'required|string|max:255',
            'price' => 'required|numeric|min:0',
            'author_id' => 'required|exists:authors,id',
        ];
    }
}

Copy// app/Http/Controllers/BookController.php
use App\Http\Requests\StoreBookRequest;

public function store(StoreBookRequest $request)
{
    // By the time this method body runs, validation has ALREADY passed —
    // an invalid request never reaches this line at all.
    Book::create($request->validated());
    return redirect()->route('books.index');
}

Copyform = BookForm(request.POST)
if form.is_valid():
    form.save()
    return redirect("book-list")
# explicit check — invalid path handled by falling through

Copypublic function store(StoreBookRequest $request)
{
    Book::create($request->validated());
    return redirect()->route('books.index');
}
// no explicit check — invalid requests never reach the method body

🛡️ Built-in CSRF Protection

The exact same "already on by default" story as Django's CSRF chapter — VerifyCsrfToken middleware is already active, and Blade's @csrf directive is the one-line template requirement:

Copy<form method="POST" action="{{ route('books.store') }}">
  @csrf
  <input type="text" name="title">
  <button type="submit">Save</button>
</form>

@csrf compiles to a hidden _token input field, matched against a token stored in the session — the same synchronizer token pattern from the dedicated CSRF course, just expressed as one Blade directive instead of Django's {% csrf_token %}.

Displaying Validation Errors

An $errors variable is automatically shared with every view after a failed validation redirect — no controller code needed to pass it in:

Copy<form method="POST" action="{{ route('books.store') }}">
  @csrf
  <input type="text" name="title" value="{{ old('title') }}">
  @error('title')
    <p class="error">{{ $message }}</p>
  @enderror
  <button type="submit">Save</button>
</form>

Two Layers of the Same Defense: validated() + $fillable

$request->validated() returns only the fields that were actually declared in rules() — paired with Chapter 5's $fillable, this is the same two-layer mass-assignment defense Django's Forms chapter built with ModelForm.Meta.fields:

Copy// Even if an attacker adds an extra "is_admin" field to the request body:
Book::create($request->validated());
// validated() only returns keys declared in rules() — "is_admin" was never
// declared there, so it's dropped before it ever reaches create(). And even
// if it somehow got through, Book's own $fillable would block it too.

💻 Coding Challenges

🎯 What's Next

The final chapter of this course covers the two pieces holding everything together behind the scenes: Middleware & Artisan — Laravel's middleware pipeline, more Artisan commands, and how .env configuration ties back to everything covered so far.