📝 Form Handling in Laravel

The Form Round-Trip

A form is a two-way bridge between the user and your data. The user fills fields in the browser and submits; the browser packages those fields into an HTTP request and sends them to a route; a controller reads, validates, and stores the data; then the app responds — usually a redirect with a flash message. Understanding this round-trip is the key to every form you'll ever write.

Notice the two exits from the "Valid?" gate. A well-built form handles both: the happy path (save and confirm) and the sad path (send the user back with their input preserved and clear error messages). Laravel gives you first-class tools for each, and we'll use every one of them here.

Building a Form in Blade

Every Laravel form starts as HTML in a Blade template. The anatomy is simple: an action that points at a named route, a method, the @csrf directive, named inputs, and the old() helper to survive validation failures.

{{-- resources/views/contact.blade.php --}}
<form action="{{ route('contact.submit') }}" method="POST">
    @csrf

    <div class="form-group">
        <label for="name">Name</label>
        <input type="text" id="name" name="name" value="{{ old('name') }}">
    </div>

    <div class="form-group">
        <label for="email">Email</label>
        <input type="email" id="email" name="email" value="{{ old('email') }}">
    </div>

    <div class="form-group">
        <label for="message">Message</label>
        <textarea id="message" name="message" rows="5">{{ old('message') }}</textarea>
    </div>

    <button type="submit">Send Message</button>
</form>

Each piece earns its place:

• route('contact.submit') — always target a named route, never a hardcoded URL. Rename the URL later and the form keeps working.
• method="POST" — form submissions that change data should never be GET (GET requests get cached, bookmarked, and prefetched).
• @csrf — the security token, covered in the next section.
• name="..." — the key you'll use on the server to read the value. No name, no data.
• old('name') — pulls the previously submitted value back into the field after a failed validation redirect.

CSRF & Method Spoofing

Cross-Site Request Forgery protection

The @csrf directive expands into a hidden field carrying a token that Laravel's middleware verifies on every state-changing request:

<!-- What @csrf renders -->
<input type="hidden" name="_token" value="a-long-random-per-session-token">

Think of it as a tamper-evident seal. Because a malicious third-party page can't read your session's token, it can't forge a valid submission. Forget the @csrf directive and Laravel returns a 419 Page Expired response — a classic "why won't my form submit?" moment.

Spoofing PUT, PATCH, and DELETE

HTML forms only speak GET and POST. To hit a RESTful update or destroy route, add the @method directive, which injects a hidden _method field Laravel reads to override the verb:

<form action="{{ route('users.update', $user) }}" method="POST">
    @csrf
    @method('PUT')
    <!-- form fields -->
    <button type="submit">Update</button>
</form>

The browser still sends a POST; Laravel treats it as a PUT when routing. This is exactly what Route::resource expects for its update endpoints.

Processing the Submission

A form needs two routes: one GET to display it, one POST to receive it. In Laravel 11, web routes live in routes/web.php:

<?php
// routes/web.php
use App\Http\Controllers\ContactController;

Route::get('/contact', [ContactController::class, 'show'])->name('contact.show');
Route::post('/contact', [ContactController::class, 'submit'])->name('contact.submit');

The controller displays the view and, on submission, reads the input, does the work, and redirects with a flash message:

<?php
// app/Http/Controllers/ContactController.php
namespace App\Http\Controllers;

use Illuminate\Http\Request;
use App\Mail\ContactMessage;
use Illuminate\Support\Facades\Mail;

class ContactController extends Controller
{
    public function show()
    {
        return view('contact');
    }

    public function submit(Request $request)
    {
        // Validate first — an invalid request never reaches the logic below
        $validated = $request->validate([
            'name'    => 'required|string|max:255',
            'email'   => 'required|email',
            'message' => 'required|string|min:10',
        ]);

        // Do the work (send an email, save a record, etc.)
        Mail::to('team@example.com')->send(new ContactMessage($validated));

        // Redirect with a one-request flash message
        return redirect()
            ->route('contact.show')
            ->with('success', 'Your message has been sent!');
    }
}

The redirect()->with() pattern follows the Post/Redirect/Get convention: after a successful POST, redirect so a browser refresh doesn't resubmit the form. Show the flash message in Blade:

@if (session('success'))
    <div class="alert alert-success">{{ session('success') }}</div>
@endif

The Request Object

The Illuminate\Http\Request object is your window onto everything the user sent. Type-hint it on a controller method and Laravel injects it automatically. Prefer validate() for real work, but these accessors are invaluable for inspecting input:

public function submit(Request $request)
{
    // A single field
    $name = $request->input('name');

    // A single field with a fallback default
    $name = $request->input('name', 'Guest');

    // Only these fields (great for building a whitelist)
    $credentials = $request->only(['email', 'password']);

    // Everything except these
    $data = $request->except(['_token', '_method']);

    // Presence checks
    if ($request->has('newsletter')) { /* the key exists */ }
    if ($request->filled('name'))    { /* exists AND not empty */ }

    // Everything as an array (use with care — never mass-assign this raw)
    $all = $request->all();
}

Request metadata

Beyond input, the request carries useful context:

Handling File Uploads

File uploads need one extra thing on the form: enctype="multipart/form-data". Without it, the browser sends only the filename, not the bytes.

<form action="{{ route('profile.update') }}" method="POST" enctype="multipart/form-data">
    @csrf
    @method('PUT')

    <label for="avatar">Profile Picture</label>
    <input type="file" id="avatar" name="avatar">

    <button type="submit">Update Profile</button>
</form>

On the server, the uploaded file is a Illuminate\Http\UploadedFile instance. Validate it, inspect it, then store it:

public function update(Request $request)
{
    $request->validate([
        'avatar' => 'required|image|max:2048', // image, max 2 MB (2048 KB)
    ]);

    if ($request->hasFile('avatar')) {
        $file = $request->file('avatar');

        // Inspect properties
        $extension = $file->extension();          // guessed from content
        $size      = $file->getSize();            // bytes

        // Store on the "public" disk under storage/app/public/avatars,
        // letting Laravel generate a unique, unguessable filename
        $path = $file->store('avatars', 'public');

        // Or store with a deterministic name
        $path = $file->storeAs('avatars', 'user_' . $request->user()->id . '.' . $extension, 'public');

        $request->user()->update(['avatar' => $path]);
    }

    return back()->with('success', 'Profile updated!');
}

Worked Example: Create a Post

Let's tie everything together into a real "create a blog post" flow — route, controller, and Blade view with error display, old input, a select, and a file upload.

Routes

<?php
// routes/web.php
use App\Http\Controllers\PostController;

Route::get('/posts/create', [PostController::class, 'create'])->name('posts.create');
Route::post('/posts', [PostController::class, 'store'])->name('posts.store');

Controller

<?php
// app/Http/Controllers/PostController.php
namespace App\Http\Controllers;

use App\Models\Post;
use App\Models\Category;
use Illuminate\Http\Request;
use Illuminate\Support\Str;

class PostController extends Controller
{
    public function create()
    {
        return view('posts.create', [
            'categories' => Category::orderBy('name')->get(),
        ]);
    }

    public function store(Request $request)
    {
        $validated = $request->validate([
            'title'       => 'required|string|max:255',
            'category_id' => 'required|exists:categories,id',
            'content'     => 'required|string|min:50',
            'image'       => 'nullable|image|max:2048',
        ]);

        // Derive a slug; attach the author
        $validated['slug']    = Str::slug($validated['title']);
        $validated['user_id'] = $request->user()->id;

        $post = Post::create($validated);

        if ($request->hasFile('image')) {
            $path = $request->file('image')->store('posts', 'public');
            $post->update(['image' => $path]);
        }

        return redirect()
            ->route('posts.show', $post)
            ->with('success', 'Post created successfully!');
    }
}

View

{{-- resources/views/posts/create.blade.php --}}
@extends('layouts.app')

@section('content')
<div class="container">
    <h1>Create New Post</h1>

    @if ($errors->any())
        <div class="alert alert-danger">
            <ul>
                @foreach ($errors->all() as $error)
                    <li>{{ $error }}</li>
                @endforeach
            </ul>
        </div>
    @endif

    <form action="{{ route('posts.store') }}" method="POST" enctype="multipart/form-data">
        @csrf

        <div class="form-group">
            <label for="title">Title</label>
            <input type="text" id="title" name="title"
                   value="{{ old('title') }}"
                   class="@error('title') is-invalid @enderror">
            @error('title') <div class="invalid-feedback">{{ $message }}</div> @enderror
        </div>

        <div class="form-group">
            <label for="category_id">Category</label>
            <select id="category_id" name="category_id">
                <option value="">Select a category</option>
                @foreach ($categories as $category)
                    <option value="{{ $category->id }}"
                        @selected(old('category_id') == $category->id)>
                        {{ $category->name }}
                    </option>
                @endforeach
            </select>
            @error('category_id') <div class="invalid-feedback">{{ $message }}</div> @enderror
        </div>

        <div class="form-group">
            <label for="content">Content</label>
            <textarea id="content" name="content" rows="10">{{ old('content') }}</textarea>
            @error('content') <div class="invalid-feedback">{{ $message }}</div> @enderror
        </div>

        <div class="form-group">
            <label for="image">Featured Image</label>
            <input type="file" id="image" name="image">
            @error('image') <div class="invalid-feedback">{{ $message }}</div> @enderror
        </div>

        <button type="submit">Create Post</button>
    </form>
</div>
@endsection

Note the modern Blade touches: @error('field') for per-field messages and @selected(...) to preselect the previously chosen option. Both keep the template terse and readable.

Title field is required.
The selected category is invalid.
Content must be at least 50 characters.

Hands-on Exercise

// routes/web.php
Route::get('/contact', [ContactController::class, 'show'])->name('contact.show');
Route::post('/contact', [ContactController::class, 'submit'])->name('contact.submit');

// ContactController@submit
public function submit(Request $request)
{
    $validated = $request->validate([
        'name'       => 'required|string|max:255',
        'email'      => 'required|email',
        'subject'    => 'required|string|max:150',
        'message'    => 'required|string|min:10',
        'attachment' => 'nullable|file|mimes:pdf|max:5120',
    ]);

    if ($request->hasFile('attachment')) {
        $validated['attachment'] = $request->file('attachment')->store('contact', 'public');
    }

    // ...store or email $validated...

    return redirect()->route('contact.show')
        ->with('success', 'Thanks — we\'ll be in touch!');
}

Best Practices

Summary & Quiz

📚 Further Reading

• Laravel Docs — HTTP Requests
• Laravel Docs — Blade Forms
• Laravel Docs — File Storage

🚀 What's Next?

You've built and processed forms, and you've seen validate() in action. Next we'll go deep on validation itself — the full rule catalog, conditional rules, and how to write your own custom validators.