Data Validation in Laravel: A Complete Developer Guide

Validation is an important boundary in web applications. It ensures incoming data has the shape and constraints your application expects before that data reaches business logic or persistence. Laravel provides several validation APIs, from quick controller validation to reusable Form Request classes and custom rules.

1. Basic Validation

For small request handlers, call validate() on the request:

use Illuminate\Http\Request;

public function store(Request $request)
{
    $validatedData = $request->validate([
        'name' => ['required', 'string', 'max:255'],
        'email' => ['required', 'email', 'unique:users,email'],
        'password' => ['required', 'string', 'min:8', 'confirmed'],
    ]);

    // Use $validatedData rather than the entire request payload.
}

For a normal browser request, Laravel redirects back with validation errors in the session. For requests expecting JSON, Laravel returns a validation error response, normally with HTTP status 422.

2. Custom Validation Messages

You can override individual validation messages:

$validatedData = $request->validate([
    'name' => ['required', 'string', 'max:255'],
    'email' => ['required', 'email', 'unique:users,email'],
    'password' => ['required', 'string', 'min:8', 'confirmed'],
], [
    'name.required' => 'Please enter your name.',
    'email.required' => 'An email address is required.',
    'password.min' => 'The password must be at least 8 characters.',
]);

For larger applications, validation messages can also live in localization files instead of being repeated in controllers.

3. Use a Form Request for Reusable Validation

Generate a Form Request:

php artisan make:request StoreUserRequest

Then define authorization and validation rules:

namespace App\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;

class StoreUserRequest extends FormRequest
{
    public function authorize(): bool
    {
        return true;
    }

    public function rules(): array
    {
        return [
            'name' => ['required', 'string', 'max:255'],
            'email' => ['required', 'email', 'unique:users,email'],
            'password' => ['required', 'string', 'min:8', 'confirmed'],
        ];
    }
}

The controller can then depend on the request class directly:

use App\Http\Requests\StoreUserRequest;

public function store(StoreUserRequest $request)
{
    $validatedData = $request->validated();

    // Save or process the validated data.
}

Form Requests are especially useful when rules, messages, authorization, or input preparation would otherwise make a controller difficult to read.

4. Conditional Validation

Rules can depend on whether another value is present or has a particular value.

A simple example with sometimes:

$request->validate([
    'email' => ['required', 'email'],
    'password' => ['sometimes', 'required', 'string', 'min:8', 'confirmed'],
]);

Here the password rules are applied only when password is present in the input. Laravel also provides rules such as required_if, required_unless, exclude_if, and fluent Rule APIs for more complex cases.

5. Custom Validation with a Closure

For a small one-off rule, use a closure:

$request->validate([
    'email' => [
        'required',
        'email',
        function ($attribute, $value, $fail) {
            if ($value === 'test@example.com') {
                $fail($attribute . ' is not valid.');
            }
        },
    ],
]);

If the same logic is used in multiple places, create a dedicated validation rule instead of duplicating the closure.

6. Validate Arrays and Uploaded Files

Laravel’s dot notation can validate each item in an array:

$request->validate([
    'photos' => ['required', 'array'],
    'photos.*' => ['image', 'mimes:jpg,jpeg,png', 'max:2048'],
]);

Each photos.* item must be an accepted image no larger than the configured size limit.

Validation should be treated as one layer of file-upload security. Store uploads safely, generate server-controlled filenames, and do not execute content from public upload directories.

7. Validate Unique Values During Updates

A common mistake is using the create-time unique rule unchanged during an update. Ignore the record currently being edited:

use Illuminate\Validation\Rule;

$request->validate([
    'email' => [
        'required',
        'email',
        Rule::unique('users', 'email')->ignore($user->id),
    ],
]);

Do not pass untrusted user input as the ID to ignore(); use a trusted model identifier.

Conclusion

Laravel validation scales from a few inline rules to structured Form Requests and custom rule objects. Validate at the application boundary, use the validated payload instead of blindly accepting all request fields, and keep authorization separate from validation even when both live in the same Form Request class.