📝 Form Handling and Validation

The Form Lifecycle

Every form submission travels the same road: the browser sends a request, Laravel checks it is genuine, extracts and validates the data, does the work, and sends a response. Understanding this flow tells you exactly where each tool fits.

💡 Analogy: Handling a form is like a post office processing mail. You confirm the sender is real (CSRF), check the envelope meets requirements (validation), open the contents (request data), act on the letter (business logic), and send a reply (redirect).

Building a Blade Form

A well-built Laravel form uses four Blade tools together: @csrf for security, route() for the action URL, old() to repopulate fields after a failed submit, and @error to show messages inline.

<form action="{{ route('products.store') }}" method="POST">
    @csrf

    <div class="form-group">
        <label for="name">Product Name</label>
        <input type="text" name="name" id="name"
               value="{{ old('name') }}"
               class="@error('name') is-invalid @enderror">
        @error('name')
            <p class="invalid-feedback">{{ $message }}</p>
        @enderror
    </div>

    <div class="form-group">
        <label for="price">Price</label>
        <input type="number" step="0.01" name="price" id="price"
               value="{{ old('price') }}"
               class="@error('price') is-invalid @enderror">
        @error('price')
            <p class="invalid-feedback">{{ $message }}</p>
        @enderror
    </div>

    <button type="submit">Create Product</button>
</form>

Method spoofing for PUT / PATCH / DELETE

HTML forms can only send GET and POST. To hit a RESTful PUT, PATCH, or DELETE route, add the @method directive — Laravel reads the hidden _method field and routes accordingly.

<form action="{{ route('products.update', $product) }}" method="POST">
    @csrf
    @method('PUT')
    <!-- fields -->
    <button type="submit">Update</button>
</form>

<form action="{{ route('products.destroy', $product) }}" method="POST">
    @csrf
    @method('DELETE')
    <button type="submit">Delete</button>
</form>

Accessing Request Data

Laravel injects an Illuminate\Http\Request object into your controller method. It offers precise, expressive ways to read input rather than touching PHP's raw $_POST.

public function store(Request $request)
{
    $all   = $request->all();                    // everything
    $name  = $request->input('name');            // one field
    $name  = $request->name;                     // shorthand
    $sort  = $request->input('sort', 'created_at'); // with a default

    if ($request->filled('email')) { /* present and not empty */ }

    $creds   = $request->only(['email', 'password']);
    $payload = $request->except(['_token', '_method']);
    $street  = $request->input('address.street');   // nested / dot notation
}

💡 Analogy: The Request object is a personal assistant who has already sorted the incoming paperwork. You ask for exactly the document you need instead of rummaging through the whole pile.

Validation Fundamentals

Never trust input. The simplest way to validate is $request->validate(). If any rule fails, Laravel automatically redirects back with the errors and the old input flashed to the session — you write no branching code for the failure path.

public function store(Request $request)
{
    $validated = $request->validate([
        'name'     => 'required|string|max:255',
        'email'    => 'required|email|unique:users,email',
        'password' => 'required|min:8|confirmed',
        'age'      => 'nullable|integer|min:18',
        'terms'    => 'accepted',
    ]);

    // Only reached when validation passes; $validated is safe to use.
    User::create($validated);

    return redirect()->route('dashboard')
                     ->with('success', 'Account created!');
}

Custom messages

$request->validate([
    'email'    => 'required|email|unique:users,email',
    'password' => 'required|min:8|confirmed',
], [
    'email.unique'      => 'That email is already registered.',
    'password.min'      => 'Use at least 8 characters.',
    'password.confirmed'=> 'The passwords do not match.',
]);

💡 Analogy: Validation is the bouncer at a club: each piece of data must meet the entry rules before it gets inside your application.

Rules & Custom Rules

Laravel ships with dozens of rules covering strings, numbers, dates, files, and arrays. A few representative examples:

A custom rule with a closure

$request->validate([
    'password' => [
        'required', 'min:8',
        function ($attribute, $value, $fail) {
            if (strtolower($value) === 'password') {
                $fail('The '.$attribute.' is too obvious.');
            }
        },
    ],
]);

A reusable rule object

For rules you'll use across the app, generate a rule class with php artisan make:rule StrongPassword. Modern Laravel uses the ValidationRule interface:

namespace App\Rules;

use Closure;
use Illuminate\Contracts\Validation\ValidationRule;

class StrongPassword implements ValidationRule
{
    public function validate(string $attribute, mixed $value, Closure $fail): void
    {
        // At least one lower, one upper, one digit, min 8 chars.
        if (! preg_match('/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$/', $value)) {
            $fail('The :attribute needs upper- and lower-case letters and a number.');
        }
    }
}

// Usage
$request->validate([
    'password' => ['required', new StrongPassword],
]);

Form Request Classes

When validation grows, move it out of the controller into a Form Request. It bundles authorization and rules in one testable class, and it validates automatically the moment you type-hint it in a controller method.

php artisan make:request StoreProductRequest

namespace App\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Support\Str;

class StoreProductRequest extends FormRequest
{
    // Return false to reject the request with a 403.
    public function authorize(): bool
    {
        return $this->user()->can('create', \App\Models\Product::class);
    }

    public function rules(): array
    {
        return [
            'name'        => 'required|string|max:255',
            'category_id' => 'required|integer|exists:categories,id',
            'price'       => 'required|numeric|min:0',
            'image'       => 'nullable|image|max:2048',
            'tags'        => 'nullable|array',
            'tags.*'      => 'exists:tags,id',
        ];
    }

    public function messages(): array
    {
        return ['category_id.exists' => 'That category no longer exists.'];
    }

    // Tweak the data before rules run.
    protected function prepareForValidation(): void
    {
        $this->merge(['slug' => Str::slug($this->name)]);
    }
}

// The controller stays thin — validation already happened.
public function store(StoreProductRequest $request)
{
    $product = Product::create($request->validated());
    $product->tags()->sync($request->input('tags', []));

    return redirect()->route('products.show', $product)
                     ->with('success', 'Product created!');
}

File Uploads

A form that uploads files needs enctype="multipart/form-data". Validate the file, then store it — store() generates a safe, unique filename and returns the path to save in your database.

<form action="{{ route('products.store') }}" method="POST"
      enctype="multipart/form-data">
    @csrf
    <input type="file" name="image">
    <button type="submit">Upload</button>
</form>

public function store(Request $request)
{
    $request->validate([
        'image' => 'required|image|max:2048',   // max 2 MB
    ]);

    if ($request->hasFile('image')) {
        // Stored under storage/app/public/products; returns e.g. "products/x7Kd.jpg"
        $path = $request->file('image')->store('products', 'public');

        Product::create([...$request->validated(), 'image_path' => $path]);
    }

    return back()->with('success', 'Uploaded!');
}

Worked Example: A Contact Form

This ties the pieces together: a Blade form, a Form Request for validation, a controller that follows Post/Redirect/Get, and a success message.

1 · The Blade view

@if (session('success'))
    <div class="alert-success">{{ session('success') }}</div>
@endif

<form action="{{ route('contact.submit') }}" method="POST">
    @csrf
    <label for="name">Your Name</label>
    <input id="name" name="name" value="{{ old('name') }}">
    @error('name') <p class="invalid-feedback">{{ $message }}</p> @enderror

    <label for="email">Email</label>
    <input id="email" type="email" name="email" value="{{ old('email') }}">
    @error('email') <p class="invalid-feedback">{{ $message }}</p> @enderror

    <label for="message">Message</label>
    <textarea id="message" name="message">{{ old('message') }}</textarea>
    @error('message') <p class="invalid-feedback">{{ $message }}</p> @enderror

    <button type="submit">Send Message</button>
</form>

2 · The Form Request

class ContactFormRequest extends FormRequest
{
    public function authorize(): bool
    {
        return true;   // anyone may use the public contact form
    }

    public function rules(): array
    {
        return [
            'name'    => 'required|string|max:100',
            'email'   => 'required|email|max:255',
            'message' => 'required|string|min:20|max:2000',
        ];
    }
}

3 · The controller & routes

class ContactController extends Controller
{
    public function show()
    {
        return view('contact');
    }

    public function submit(ContactFormRequest $request)
    {
        // Validation already passed. Send the mail.
        Mail::to(config('mail.contact_address'))
            ->send(new ContactFormMail($request->validated()));

        // Post/Redirect/Get: redirect so a refresh won't resend.
        return redirect()->route('contact')
                         ->with('success', 'Thanks! We will reply soon.');
    }
}

// routes/web.php
Route::get('/contact',  [ContactController::class, 'show'])->name('contact');
Route::post('/contact', [ContactController::class, 'submit'])->name('contact.submit');

Thanks! We will reply soon.

Hands-on Exercise

// RegisterRequest::rules()
return [
    'name'     => 'required|string|max:255',
    'email'    => 'required|email|unique:users,email',
    'password' => ['required', 'confirmed', new StrongPassword],
    'terms'    => 'accepted',
];

// Controller
public function store(RegisterRequest $request)
{
    User::create($request->safe()->only(['name', 'email', 'password']));
    return redirect()->route('login')
                     ->with('success', 'Account created — please log in.');
}

Best Practices

Summary & Quiz

📚 Further Reading

• Laravel — Validation
• Laravel — HTTP Requests
• Laravel — File Storage
• Laravel — Blade Templates

🚀 What's Next?

You can now capture and validate input securely. Next we'll identify who is submitting it — building login, registration, and access control in the Laravel Authentication System.