Validation

• Introduction
• Validation Quickstart
  • Defining the Routes
  • Creating the Controller
  • Writing the Validation Logic
  • Displaying the Validation Errors
  • Repopulating Forms
  • A Note on Optional Fields
  • Validation Error Response Format
• Form Request Validation
  • Creating Form Requests
  • Authorizing Form Requests
  • Customizing the Error Messages
  • Preparing Input for Validation
• Manually Creating Validators
  • Automatic Redirection
  • Named Error Bags
  • Customizing the Error Messages
  • Performing Additional Validation
• Working With Validated Input
• Working With Error Messages
  • Specifying Custom Messages in Language Files
  • Specifying Attributes in Language Files
  • Specifying Values in Language Files
• Available Validation Rules
• Conditionally Adding Rules
• Validating Arrays
  • Validating Nested Array Input
  • Error Message Indexes and Positions
• Validating Files
• Validating Passwords
• Custom Validation Rules
  • Using Rule Objects
  • Using Closures
  • Implicit Rules

Introduction

Laravel provides several different approaches to validate your application's incoming data. It is most common to use the validate method available on all incoming HTTP requests. However, we will discuss other approaches to validation as well.

Laravel includes a wide variety of convenient validation rules that you may apply to data, even providing the ability to validate if values are unique in a given database table. We'll cover each of these validation rules in detail so that you are familiar with all of Laravel's validation features.

Validation Quickstart

To learn about Laravel's powerful validation features, let's look at a complete example of validating a form and displaying the error messages back to the user. By reading this high-level overview, you'll be able to gain a good general understanding of how to validate incoming request data using Laravel:

Defining the Routes

First, let's assume we have the following routes defined in our routes/web.php file:

1use App\Http\Controllers\PostController;
2 
3Route::get('/post/create', [PostController::class, 'create']);
4Route::post('/post', [PostController::class, 'store']);
1use App\Http\Controllers\PostController;
2 
3Route::get('/post/create', [PostController::class, 'create']);
4Route::post('/post', [PostController::class, 'store']);

The GET route will display a form for the user to create a new blog post, while the POST route will store the new blog post in the database.

Creating the Controller

Next, let's take a look at a simple controller that handles incoming requests to these routes. We'll leave the store method empty for now:

 1<?php
 2 
 3namespace App\Http\Controllers;
 4 
 5use Illuminate\Http\RedirectResponse;
 6use Illuminate\Http\Request;
 7use Illuminate\View\View;
 8 
 9class PostController extends Controller
10{
11    /**
12     * Show the form to create a new blog post.
13     */
14    public function create(): View
15    {
16        return view('post.create');
17    }
18 
19    /**
20     * Store a new blog post.
21     */
22    public function store(Request $request): RedirectResponse
23    {
24        // Validate and store the blog post...
25 
26        $post = /** ... */
27 
28        return to_route('post.show', ['post' => $post->id]);
29    }
30}
 1<?php
 2 
 3namespace App\Http\Controllers;
 4 
 5use Illuminate\Http\RedirectResponse;
 6use Illuminate\Http\Request;
 7use Illuminate\View\View;
 8 
 9class PostController extends Controller
10{
11    /**
12     * Show the form to create a new blog post.
13     */
14    public function create(): View
15    {
16        return view('post.create');
17    }
18 
19    /**
20     * Store a new blog post.
21     */
22    public function store(Request $request): RedirectResponse
23    {
24        // Validate and store the blog post...
25 
26        $post = /** ... */
27 
28        return to_route('post.show', ['post' => $post->id]);
29    }
30}

Writing the Validation Logic

Now we are ready to fill in our store method with the logic to validate the new blog post. To do this, we will use the validate method provided by the Illuminate\Http\Request object. If the validation rules pass, your code will keep executing normally; however, if validation fails, an Illuminate\Validation\ValidationException exception will be thrown and the proper error response will automatically be sent back to the user.

If validation fails during a traditional HTTP request, a redirect response to the previous URL will be generated. If the incoming request is an XHR request, a JSON response containing the validation error messages will be returned.

To get a better understanding of the validate method, let's jump back into the store method:

 1/**
 2 * Store a new blog post.
 3 */
 4public function store(Request $request): RedirectResponse
 5{
 6    $validated = $request->validate([
 7        'title' => 'required|unique:posts|max:255',
 8        'body' => 'required',
 9    ]);
10 
11    // The blog post is valid...
12 
13    return redirect('/posts');
14}
 1/**
 2 * Store a new blog post.
 3 */
 4public function store(Request $request): RedirectResponse
 5{
 6    $validated = $request->validate([
 7        'title' => 'required|unique:posts|max:255',
 8        'body' => 'required',
 9    ]);
10 
11    // The blog post is valid...
12 
13    return redirect('/posts');
14}

As you can see, the validation rules are passed into the validate method. Don't worry - all available validation rules are documented. Again, if the validation fails, the proper response will automatically be generated. If the validation passes, our controller will continue executing normally.

Alternatively, validation rules may be specified as arrays of rules instead of a single | delimited string:

1$validatedData = $request->validate([
2    'title' => ['required', 'unique:posts', 'max:255'],
3    'body' => ['required'],
4]);
1$validatedData = $request->validate([
2    'title' => ['required', 'unique:posts', 'max:255'],
3    'body' => ['required'],
4]);

In addition, you may use the validateWithBag method to validate a request and store any error messages within a named error bag:

1$validatedData = $request->validateWithBag('post', [
2    'title' => ['required', 'unique:posts', 'max:255'],
3    'body' => ['required'],
4]);
1$validatedData = $request->validateWithBag('post', [
2    'title' => ['required', 'unique:posts', 'max:255'],
3    'body' => ['required'],
4]);

Stopping on First Validation Failure

Sometimes you may wish to stop running validation rules on an attribute after the first validation failure. To do so, assign the bail rule to the attribute:

1$request->validate([
2    'title' => 'bail|required|unique:posts|max:255',
3    'body' => 'required',
4]);
1$request->validate([
2    'title' => 'bail|required|unique:posts|max:255',
3    'body' => 'required',
4]);

In this example, if the unique rule on the title attribute fails, the max rule will not be checked. Rules will be validated in the order they are assigned.

A Note on Nested Attributes

If the incoming HTTP request contains "nested" field data, you may specify these fields in your validation rules using "dot" syntax:

1$request->validate([
2    'title' => 'required|unique:posts|max:255',
3    'author.name' => 'required',
4    'author.description' => 'required',
5]);
1$request->validate([
2    'title' => 'required|unique:posts|max:255',
3    'author.name' => 'required',
4    'author.description' => 'required',
5]);

On the other hand, if your field name contains a literal period, you can explicitly prevent this from being interpreted as "dot" syntax by escaping the period with a backslash:

1$request->validate([
2    'title' => 'required|unique:posts|max:255',
3    'v1\.0' => 'required',
4]);
1$request->validate([
2    'title' => 'required|unique:posts|max:255',
3    'v1\.0' => 'required',
4]);

Displaying the Validation Errors

So, what if the incoming request fields do not pass the given validation rules? As mentioned previously, Laravel will automatically redirect the user back to their previous location. In addition, all of the validation errors and request input will automatically be flashed to the session.

An $errors variable is shared with all of your application's views by the Illuminate\View\Middleware\ShareErrorsFromSession middleware, which is provided by the web middleware group. When this middleware is applied an $errors variable will always be available in your views, allowing you to conveniently assume the $errors variable is always defined and can be safely used. The $errors variable will be an instance of Illuminate\Support\MessageBag. For more information on working with this object, check out its documentation.

So, in our example, the user will be redirected to our controller's create method when validation fails, allowing us to display the error messages in the view:

 1<!-- /resources/views/post/create.blade.php -->
 2 
 3<h1>Create Post</h1>
 4 
 5@if ($errors->any())
 6    <div class="alert alert-danger">
 7        <ul>
 8            @foreach ($errors->all() as $error)
 9                <li>{{ $error }}</li>
10            @endforeach
11        </ul>
12    </div>
13@endif
14 
15<!-- Create Post Form -->
 1<!-- /resources/views/post/create.blade.php -->
 2 
 3<h1>Create Post</h1>
 4 
 5@if ($errors->any())
 6    <div class="alert alert-danger">
 7        <ul>
 8            @foreach ($errors->all() as $error)
 9                <li>{{ $error }}</li>
10            @endforeach
11        </ul>
12    </div>
13@endif
14 
15<!-- Create Post Form -->

Customizing the Error Messages

Laravel's built-in validation rules each have an error message that is located in your application's lang/en/validation.php file. If your application does not have a lang directory, you may instruct Laravel to create it using the lang:publish Artisan command.

Within the lang/en/validation.php file, you will find a translation entry for each validation rule. You are free to change or modify these messages based on the needs of your application.

In addition, you may copy this file to another language directory to translate the messages for your application's language. To learn more about Laravel localization, check out the complete localization documentation.

[!WARNING]
By default, the Laravel application skeleton does not include the lang directory. If you would like to customize Laravel's language files, you may publish them via the lang:publish Artisan command.

XHR Requests and Validation

In this example, we used a traditional form to send data to the application. However, many applications receive XHR requests from a JavaScript powered frontend. When using the validate method during an XHR request, Laravel will not generate a redirect response. Instead, Laravel generates a JSON response containing all of the validation errors. This JSON response will be sent with a 422 HTTP status code.

The @error Directive

You may use the @error Blade directive to quickly determine if validation error messages exist for a given attribute. Within an @error directive, you may echo the $message variable to display the error message:

 1<!-- /resources/views/post/create.blade.php -->
 2 
 3<label for="title">Post Title</label>
 4 
 5<input id="title"
 6    type="text"
 7    name="title"
 8    class="@error('title') is-invalid @enderror">
 9 
10@error('title')
11    <div class="alert alert-danger">{{ $message }}</div>
12@enderror
 1<!-- /resources/views/post/create.blade.php -->
 2 
 3<label for="title">Post Title</label>
 4 
 5<input id="title"
 6    type="text"
 7    name="title"
 8    class="@error('title') is-invalid @enderror">
 9 
10@error('title')
11    <div class="alert alert-danger">{{ $message }}</div>
12@enderror

If you are using named error bags, you may pass the name of the error bag as the second argument to the @error directive:

1<input ... class="@error('title', 'post') is-invalid @enderror">
1<input ... class="@error('title', 'post') is-invalid @enderror">

Repopulating Forms

When Laravel generates a redirect response due to a validation error, the framework will automatically flash all of the request's input to the session. This is done so that you may conveniently access the input during the next request and repopulate the form that the user attempted to submit.

To retrieve flashed input from the previous request, invoke the old method on an instance of Illuminate\Http\Request. The old method will pull the previously flashed input data from the session:

1$title = $request->old('title');
1$title = $request->old('title');

Laravel also provides a global old helper. If you are displaying old input within a Blade template, it is more convenient to use the old helper to repopulate the form. If no old input exists for the given field, null will be returned:

1<input type="text" name="title" value="{{ old('title') }}">
1<input type="text" name="title" value="{{ old('title') }}">

A Note on Optional Fields

By default, Laravel includes the TrimStrings and ConvertEmptyStringsToNull middleware in your application's global middleware stack. These middleware are listed in the stack by the App\Http\Kernel class. Because of this, you will often need to mark your "optional" request fields as nullable if you do not want the validator to consider null values as invalid. For example:

1$request->validate([
2    'title' => 'required|unique:posts|max:255',
3    'body' => 'required',
4    'publish_at' => 'nullable|date',
5]);
1$request->validate([
2    'title' => 'required|unique:posts|max:255',
3    'body' => 'required',
4    'publish_at' => 'nullable|date',
5]);

In this example, we are specifying that the publish_at field may be either null or a valid date representation. If the nullable modifier is not added to the rule definition, the validator would consider null an invalid date.

Validation Error Response Format

When your application throws a Illuminate\Validation\ValidationException exception and the incoming HTTP request is expecting a JSON response, Laravel will automatically format the error messages for you and return a 422 Unprocessable Entity HTTP response.

Below, you can review an example of the JSON response format for validation errors. Note that nested error keys are flattened into "dot" notation format:

 1{
 2    "message": "The team name must be a string. (and 4 more errors)",
 3    "errors": {
 4        "team_name": [
 5            "The team name must be a string.",
 6            "The team name must be at least 1 characters."
 7        ],
 8        "authorization.role": [
 9            "The selected authorization.role is invalid."
10        ],
11        "users.0.email": [
12            "The users.0.email field is required."
13        ],
14        "users.2.email": [
15            "The users.2.email must be a valid email address."
16        ]
17    }
18}
 1{
 2    "message": "The team name must be a string. (and 4 more errors)",
 3    "errors": {
 4        "team_name": [
 5            "The team name must be a string.",
 6            "The team name must be at least 1 characters."
 7        ],
 8        "authorization.role": [
 9            "The selected authorization.role is invalid."
10        ],
11        "users.0.email": [
12            "The users.0.email field is required."
13        ],
14        "users.2.email": [
15            "The users.2.email must be a valid email address."
16        ]
17    }
18}

Form Request Validation

Creating Form Requests

For more complex validation scenarios, you may wish to create a "form request". Form requests are custom request classes that encapsulate their own validation and authorization logic. To create a form request class, you may use the make:request Artisan CLI command:

1php artisan make:request StorePostRequest
1php artisan make:request StorePostRequest

The generated form request class will be placed in the app/Http/Requests directory. If this directory does not exist, it will be created when you run the make:request command. Each form request generated by Laravel has two methods: authorize and rules.

As you might have guessed, the authorize method is responsible for determining if the currently authenticated user can perform the action represented by the request, while the rules method returns the validation rules that should apply to the request's data:

 1/**
 2 * Get the validation rules that apply to the request.
 3 *
 4 * @return array<string, \Illuminate\Contracts\Validation\Rule|array|string>
 5 */
 6public function rules(): array
 7{
 8    return [
 9        'title' => 'required|unique:posts|max:255',
10        'body' => 'required',
11    ];
12}
 1/**
 2 * Get the validation rules that apply to the request.
 3 *
 4 * @return array<string, \Illuminate\Contracts\Validation\Rule|array|string>
 5 */
 6public function rules(): array
 7{
 8    return [
 9        'title' => 'required|unique:posts|max:255',
10        'body' => 'required',
11    ];
12}

[!NOTE]
You may type-hint any dependencies you require within the rules method's signature. They will automatically be resolved via the Laravel service container.

So, how are the validation rules evaluated? All you need to do is type-hint the request on your controller method. The incoming form request is validated before the controller method is called, meaning you do not need to clutter your controller with any validation logic:

 1/**
 2 * Store a new blog post.
 3 */
 4public function store(StorePostRequest $request): RedirectResponse
 5{
 6    // The incoming request is valid...
 7 
 8    // Retrieve the validated input data...
 9    $validated = $request->validated();
10 
11    // Retrieve a portion of the validated input data...
12    $validated = $request->safe()->only(['name', 'email']);
13    $validated = $request->safe()->except(['name', 'email']);
14 
15    // Store the blog post...
16 
17    return redirect('/posts');
18}
 1/**
 2 * Store a new blog post.
 3 */
 4public function store(StorePostRequest $request): RedirectResponse
 5{
 6    // The incoming request is valid...
 7 
 8    // Retrieve the validated input data...
 9    $validated = $request->validated();
10 
11    // Retrieve a portion of the validated input data...
12    $validated = $request->safe()->only(['name', 'email']);
13    $validated = $request->safe()->except(['name', 'email']);
14 
15    // Store the blog post...
16 
17    return redirect('/posts');
18}

If validation fails, a redirect response will be generated to send the user back to their previous location. The errors will also be flashed to the session so they are available for display. If the request was an XHR request, an HTTP response with a 422 status code will be returned to the user including a JSON representation of the validation errors.

[!NOTE]
Need to add real-time form request validation to your Inertia powered Laravel frontend? Check out Laravel Precognition.

Performing Additional Validation

Sometimes you need to perform additional validation after your initial validation is complete. You can accomplish this using the form request's after method.

The after method should return an array of callables or closures which will be invoked after validation is complete. The given callables will receive an Illuminate\Validation\Validator instance, allowing you to raise additional error messages if necessary:

 1use Illuminate\Validation\Validator;
 2 
 3/**
 4 * Get the "after" validation callables for the request.
 5 */
 6public function after(): array
 7{
 8    return [
 9        function (Validator $validator) {
10            if ($this->somethingElseIsInvalid()) {
11                $validator->errors()->add(
12                    'field',
13                    'Something is wrong with this field!'
14                );
15            }
16        }
17    ];
18}
 1use Illuminate\Validation\Validator;
 2 
 3/**
 4 * Get the "after" validation callables for the request.
 5 */
 6public function after(): array
 7{
 8    return [
 9        function (Validator $validator) {
10            if ($this->somethingElseIsInvalid()) {
11                $validator->errors()->add(
12                    'field',
13                    'Something is wrong with this field!'
14                );
15            }
16        }
17    ];
18}

As noted, the array returned by the after method may also contain invokable classes. The __invoke method of these classes will receive an Illuminate\Validation\Validator instance:

 1use App\Validation\ValidateShippingTime;
 2use App\Validation\ValidateUserStatus;
 3use Illuminate\Validation\Validator;
 4 
 5/**
 6 * Get the "after" validation callables for the request.
 7 */
 8public function after(): array
 9{
10    return [
11        new ValidateUserStatus,
12        new ValidateShippingTime,
13        function (Validator $validator) {
14            //
15        }
16    ];
17}
 1use App\Validation\ValidateShippingTime;
 2use App\Validation\ValidateUserStatus;
 3use Illuminate\Validation\Validator;
 4 
 5/**
 6 * Get the "after" validation callables for the request.
 7 */
 8public function after(): array
 9{
10    return [
11        new ValidateUserStatus,
12        new ValidateShippingTime,
13        function (Validator $validator) {
14            //
15        }
16    ];
17}

Stopping on the First Validation Failure

By adding a stopOnFirstFailure property to your request class, you may inform the validator that it should stop validating all attributes once a single validation failure has occurred:

1/**
2 * Indicates if the validator should stop on the first rule failure.
3 *
4 * @var bool
5 */
6protected $stopOnFirstFailure = true;
1/**
2 * Indicates if the validator should stop on the first rule failure.
3 *
4 * @var bool
5 */
6protected $stopOnFirstFailure = true;

Customizing the Redirect Location

As previously discussed, a redirect response will be generated to send the user back to their previous location when form request validation fails. However, you are free to customize this behavior. To do so, define a $redirect property on your form request:

1/**
2 * The URI that users should be redirected to if validation fails.
3 *
4 * @var string
5 */
6protected $redirect = '/dashboard';
1/**
2 * The URI that users should be redirected to if validation fails.
3 *
4 * @var string
5 */
6protected $redirect = '/dashboard';

Or, if you would like to redirect users to a named route, you may define a $redirectRoute property instead:

1/**
2 * The route that users should be redirected to if validation fails.
3 *
4 * @var string
5 */
6protected $redirectRoute = 'dashboard';
1/**
2 * The route that users should be redirected to if validation fails.
3 *
4 * @var string
5 */
6protected $redirectRoute = 'dashboard';

Authorizing Form Requests

The form request class also contains an authorize method. Within this method, you may determine if the authenticated user actually has the authority to update a given resource. For example, you may determine if a user actually owns a blog comment they are attempting to update. Most likely, you will interact with your authorization gates and policies within this method:

 1use App\Models\Comment;
 2 
 3/**
 4 * Determine if the user is authorized to make this request.
 5 */
 6public function authorize(): bool
 7{
 8    $comment = Comment::find($this->route('comment'));
 9 
10    return $comment && $this->user()->can('update', $comment);
11}
 1use App\Models\Comment;
 2 
 3/**
 4 * Determine if the user is authorized to make this request.
 5 */
 6public function authorize(): bool
 7{
 8    $comment = Comment::find($this->route('comment'));
 9 
10    return $comment && $this->user()->can('update', $comment);
11}

Since all form requests extend the base Laravel request class, we may use the user method to access the currently authenticated user. Also, note the call to the route method in the example above. This method grants you access to the URI parameters defined on the route being called, such as the {comment} parameter in the example below:

1Route::post('/comment/{comment}');
1Route::post('/comment/{comment}');

Therefore, if your application is taking advantage of route model binding, your code may be made even more succinct by accessing the resolved model as a property of the request:

1return $this->user()->can('update', $this->comment);
1return $this->user()->can('update', $this->comment);

If the authorize method returns false, an HTTP response with a 403 status code will automatically be returned and your controller method will not execute.

If you plan to handle authorization logic for the request in another part of your application, you may remove the authorize method completely, or simply return true:

1/**
2 * Determine if the user is authorized to make this request.
3 */
4public function authorize(): bool
5{
6    return true;
7}
1/**
2 * Determine if the user is authorized to make this request.
3 */
4public function authorize(): bool
5{
6    return true;
7}

[!NOTE]
You may type-hint any dependencies you need within the authorize method's signature. They will automatically be resolved via the Laravel service container.

Customizing the Error Messages

You may customize the error messages used by the form request by overriding the messages method. This method should return an array of attribute / rule pairs and their corresponding error messages:

 1/**
 2 * Get the error messages for the defined validation rules.
 3 *
 4 * @return array<string, string>
 5 */
 6public function messages(): array
 7{
 8    return [
 9        'title.required' => 'A title is required',
10        'body.required' => 'A message is required',
11    ];
12}
 1/**
 2 * Get the error messages for the defined validation rules.
 3 *
 4 * @return array<string, string>
 5 */
 6public function messages(): array
 7{
 8    return [
 9        'title.required' => 'A title is required',
10        'body.required' => 'A message is required',
11    ];
12}

Customizing the Validation Attributes

Many of Laravel's built-in validation rule error messages contain an :attribute placeholder. If you would like the :attribute placeholder of your validation message to be replaced with a custom attribute name, you may specify the custom names by overriding the attributes method. This method should return an array of attribute / name pairs:

 1/**
 2 * Get custom attributes for validator errors.
 3 *
 4 * @return array<string, string>
 5 */
 6public function attributes(): array
 7{
 8    return [
 9        'email' => 'email address',
10    ];
11}
 1/**
 2 * Get custom attributes for validator errors.
 3 *
 4 * @return array<string, string>
 5 */
 6public function attributes(): array
 7{
 8    return [
 9        'email' => 'email address',
10    ];
11}

Preparing Input for Validation

If you need to prepare or sanitize any data from the request before you apply your validation rules, you may use the prepareForValidation method:

 1use Illuminate\Support\Str;
 2 
 3/**
 4 * Prepare the data for validation.
 5 */
 6protected function prepareForValidation(): void
 7{
 8    $this->merge([
 9        'slug' => Str::slug($this->slug),
10    ]);
11}
 1use Illuminate\Support\Str;
 2 
 3/**
 4 * Prepare the data for validation.
 5 */
 6protected function prepareForValidation(): void
 7{
 8    $this->merge([
 9        'slug' => Str::slug($this->slug),
10    ]);
11}

Likewise, if you need to normalize any request data after validation is complete, you may use the passedValidation method:

1/**
2 * Handle a passed validation attempt.
3 */
4protected function passedValidation(): void
5{
6    $this->replace(['name' => 'Taylor']);
7}
1/**
2 * Handle a passed validation attempt.
3 */
4protected function passedValidation(): void
5{
6    $this->replace(['name' => 'Taylor']);
7}

Manually Creating Validators

If you do not want to use the validate method on the request, you may create a validator instance manually using the Validator facade. The make method on the facade generates a new validator instance:

 1<?php
 2 
 3namespace App\Http\Controllers;
 4 
 5use Illuminate\Http\RedirectResponse;
 6use Illuminate\Http\Request;
 7use Illuminate\Support\Facades\Validator;
 8 
 9class PostController extends Controller
10{
11    /**
12     * Store a new blog post.
13     */
14    public function store(Request $request): RedirectResponse
15    {
16        $validator = Validator::make($request->all(), [
17            'title' => 'required|unique:posts|max:255',
18            'body' => 'required',
19        ]);
20 
21        if ($validator->fails()) {
22            return redirect('post/create')
23                        ->withErrors($validator)
24                        ->withInput();
25        }
26 
27        // Retrieve the validated input...
28        $validated = $validator->validated();
29 
30        // Retrieve a portion of the validated input...
31        $validated = $validator->safe()->only(['name', 'email']);
32        $validated = $validator->safe()->except(['name', 'email']);
33 
34        // Store the blog post...
35 
36        return redirect('/posts');
37    }
38}
 1<?php
 2 
 3namespace App\Http\Controllers;
 4 
 5use Illuminate\Http\RedirectResponse;
 6use Illuminate\Http\Request;
 7use Illuminate\Support\Facades\Validator;
 8 
 9class PostController extends Controller
10{
11    /**
12     * Store a new blog post.
13     */
14    public function store(Request $request): RedirectResponse
15    {
16        $validator = Validator::make($request->all(), [
17            'title' => 'required|unique:posts|max:255',
18            'body' => 'required',
19        ]);
20 
21        if ($validator->fails()) {
22            return redirect('post/create')
23                        ->withErrors($validator)
24                        ->withInput();
25        }
26 
27        // Retrieve the validated input...
28        $validated = $validator->validated();
29 
30        // Retrieve a portion of the validated input...
31        $validated = $validator->safe()->only(['name', 'email']);
32        $validated = $validator->safe()->except(['name', 'email']);
33 
34        // Store the blog post...
35 
36        return redirect('/posts');
37    }
38}

The first argument passed to the make method is the data under validation. The second argument is an array of the validation rules that should be applied to the data.

After determining whether the request validation failed, you may use the withErrors method to flash the error messages to the session. When using this method, the $errors variable will automatically be shared with your views after redirection, allowing you to easily display them back to the user. The withErrors method accepts a validator, a MessageBag, or a PHP array.

Stopping on First Validation Failure

The stopOnFirstFailure method will inform the validator that it should stop validating all attributes once a single validation failure has occurred:

1if ($validator->stopOnFirstFailure()->fails()) {
2    // ...
3}
1if ($validator->stopOnFirstFailure()->fails()) {
2    // ...
3}

Automatic Redirection

If you would like to create a validator instance manually but still take advantage of the automatic redirection offered by the HTTP request's validate method, you may call the validate method on an existing validator instance. If validation fails, the user will automatically be redirected or, in the case of an XHR request, a JSON response will be returned:

1Validator::make($request->all(), [
2    'title' => 'required|unique:posts|max:255',
3    'body' => 'required',
4])->validate();
1Validator::make($request->all(), [
2    'title' => 'required|unique:posts|max:255',
3    'body' => 'required',
4])->validate();

You may use the validateWithBag method to store the error messages in a named error bag if validation fails:

1Validator::make($request->all(), [
2    'title' => 'required|unique:posts|max:255',
3    'body' => 'required',
4])->validateWithBag('post');
1Validator::make($request->all(), [
2    'title' => 'required|unique:posts|max:255',
3    'body' => 'required',
4])->validateWithBag('post');

Named Error Bags

If you have multiple forms on a single page, you may wish to name the MessageBag containing the validation errors, allowing you to retrieve the error messages for a specific form. To achieve this, pass a name as the second argument to withErrors:

1return redirect('register')->withErrors($validator, 'login');
1return redirect('register')->withErrors($validator, 'login');

You may then access the named MessageBag instance from the $errors variable:

1{{ $errors->login->first('email') }}
1{{ $errors->login->first('email') }}

Customizing the Error Messages

If needed, you may provide custom error messages that a validator instance should use instead of the default error messages provided by Laravel. There are several ways to specify custom messages. First, you may pass the custom messages as the third argument to the Validator::make method:

1$validator = Validator::make($input, $rules, $messages = [
2    'required' => 'The :attribute field is required.',
3]);
1$validator = Validator::make($input, $rules, $messages = [
2    'required' => 'The :attribute field is required.',
3]);

In this example, the :attribute placeholder will be replaced by the actual name of the field under validation. You may also utilize other placeholders in validation messages. For example:

1$messages = [
2    'same' => 'The :attribute and :other must match.',
3    'size' => 'The :attribute must be exactly :size.',
4    'between' => 'The :attribute value :input is not between :min - :max.',
5    'in' => 'The :attribute must be one of the following types: :values',
6];
1$messages = [
2    'same' => 'The :attribute and :other must match.',
3    'size' => 'The :attribute must be exactly :size.',
4    'between' => 'The :attribute value :input is not between :min - :max.',
5    'in' => 'The :attribute must be one of the following types: :values',
6];

Specifying a Custom Message for a Given Attribute

Sometimes you may wish to specify a custom error message only for a specific attribute. You may do so using "dot" notation. Specify the attribute's name first, followed by the rule:

1$messages = [
2    'email.required' => 'We need to know your email address!',
3];
1$messages = [
2    'email.required' => 'We need to know your email address!',
3];

Specifying Custom Attribute Values

Many of Laravel's built-in error messages include an :attribute placeholder that is replaced with the name of the field or attribute under validation. To customize the values used to replace these placeholders for specific fields, you may pass an array of custom attributes as the fourth argument to the Validator::make method:

1$validator = Validator::make($input, $rules, $messages, [
2    'email' => 'email address',
3]);
1$validator = Validator::make($input, $rules, $messages, [
2    'email' => 'email address',
3]);

Performing Additional Validation

Sometimes you need to perform additional validation after your initial validation is complete. You can accomplish this using the validator's after method. The after method accepts a closure or an array of callables which will be invoked after validation is complete. The given callables will receive an Illuminate\Validation\Validator instance, allowing you to raise additional error messages if necessary:

 1use Illuminate\Support\Facades\Validator;
 2 
 3$validator = Validator::make(/* ... */);
 4 
 5$validator->after(function ($validator) {
 6    if ($this->somethingElseIsInvalid()) {
 7        $validator->errors()->add(
 8            'field', 'Something is wrong with this field!'
 9        );
10    }
11});
12 
13if ($validator->fails()) {
14    // ...
15}
 1use Illuminate\Support\Facades\Validator;
 2 
 3$validator = Validator::make(/* ... */);
 4 
 5$validator->after(function ($validator) {
 6    if ($this->somethingElseIsInvalid()) {
 7        $validator->errors()->add(
 8            'field', 'Something is wrong with this field!'
 9        );
10    }
11});
12 
13if ($validator->fails()) {
14    // ...
15}

As noted, the after method also accepts an array of callables, which is particularly convenient if your "after validation" logic is encapsulated in invokable classes, which will receive an Illuminate\Validation\Validator instance via their __invoke method:

 1use App\Validation\ValidateShippingTime;
 2use App\Validation\ValidateUserStatus;
 3 
 4$validator->after([
 5    new ValidateUserStatus,
 6    new ValidateShippingTime,
 7    function ($validator) {
 8        // ...
 9    },
10]);
 1use App\Validation\ValidateShippingTime;
 2use App\Validation\ValidateUserStatus;
 3 
 4$validator->after([
 5    new ValidateUserStatus,
 6    new ValidateShippingTime,
 7    function ($validator) {
 8        // ...
 9    },
10]);

Working With Validated Input

After validating incoming request data using a form request or a manually created validator instance, you may wish to retrieve the incoming request data that actually underwent validation. This can be accomplished in several ways. First, you may call the validated method on a form request or validator instance. This method returns an array of the data that was validated:

1$validated = $request->validated();
2 
3$validated = $validator->validated();
1$validated = $request->validated();
2 
3$validated = $validator->validated();

Alternatively, you may call the safe method on a form request or validator instance. This method returns an instance of Illuminate\Support\ValidatedInput. This object exposes only, except, and all methods to retrieve a subset of the validated data or the entire array of validated data:

1$validated = $request->safe()->only(['name', 'email']);
2 
3$validated = $request->safe()->except(['name', 'email']);
4 
5$validated = $request->safe()->all();
1$validated = $request->safe()->only(['name', 'email']);
2 
3$validated = $request->safe()->except(['name', 'email']);
4 
5$validated = $request->safe()->all();

In addition, the Illuminate\Support\ValidatedInput instance may be iterated over and accessed like an array:

1// Validated data may be iterated...
2foreach ($request->safe() as $key => $value) {
3    // ...
4}
5 
6// Validated data may be accessed as an array...
7$validated = $request->safe();
8 
9$email = $validated['email'];
1// Validated data may be iterated...
2foreach ($request->safe() as $key => $value) {
3    // ...
4}
5 
6// Validated data may be accessed as an array...
7$validated = $request->safe();
8 
9$email = $validated['email'];

If you would like to add additional fields to the validated data, you may call the merge method:

1$validated = $request->safe()->merge(['name' => 'Taylor Otwell']);
1$validated = $request->safe()->merge(['name' => 'Taylor Otwell']);

If you would like to retrieve the validated data as a collection instance, you may call the collect method:

1$collection = $request->safe()->collect();
1$collection = $request->safe()->collect();

Working With Error Messages

After calling the errors method on a Validator instance, you will receive an Illuminate\Support\MessageBag instance, which has a variety of convenient methods for working with error messages. The $errors variable that is automatically made available to all views is also an instance of the MessageBag class.

Retrieving the First Error Message for a Field

To retrieve the first error message for a given field, use the first method:

1$errors = $validator->errors();
2 
3echo $errors->first('email');
1$errors = $validator->errors();
2 
3echo $errors->first('email');

Retrieving All Error Messages for a Field

If you need to retrieve an array of all the messages for a given field, use the get method:

1foreach ($errors->get('email') as $message) {
2    // ...
3}
1foreach ($errors->get('email') as $message) {
2    // ...
3}

If you are validating an array form field, you may retrieve all of the messages for each of the array elements using the * character:

1foreach ($errors->get('attachments.*') as $message) {
2    // ...
3}
1foreach ($errors->get('attachments.*') as $message) {
2    // ...
3}

Retrieving All Error Messages for All Fields

To retrieve an array of all messages for all fields, use the all method:

1foreach ($errors->all() as $message) {
2    // ...
3}
1foreach ($errors->all() as $message) {
2    // ...
3}

Determining if Messages Exist for a Field

The has method may be used to determine if any error messages exist for a given field:

1if ($errors->has('email')) {
2    // ...
3}
1if ($errors->has('email')) {
2    // ...
3}

Specifying Custom Messages in Language Files

Laravel's built-in validation rules each have an error message that is located in your application's lang/en/validation.php file. If your application does not have a lang directory, you may instruct Laravel to create it using the lang:publish Artisan command.

Within the lang/en/validation.php file, you will find a translation entry for each validation rule. You are free to change or modify these messages based on the needs of your application.

In addition, you may copy this file to another language directory to translate the messages for your application's language. To learn more about Laravel localization, check out the complete localization documentation.

[!WARNING]
By default, the Laravel application skeleton does not include the lang directory. If you would like to customize Laravel's language files, you may publish them via the lang:publish Artisan command.

Custom Messages for Specific Attributes

You may customize the error messages used for specified attribute and rule combinations within your application's validation language files. To do so, add your message customizations to the custom array of your application's lang/xx/validation.php language file:

1'custom' => [
2    'email' => [
3        'required' => 'We need to know your email address!',
4        'max' => 'Your email address is too long!'
5    ],
6],
1'custom' => [
2    'email' => [
3        'required' => 'We need to know your email address!',
4        'max' => 'Your email address is too long!'
5    ],
6],

Specifying Attributes in Language Files

Many of Laravel's built-in error messages include an :attribute placeholder that is replaced with the name of the field or attribute under validation. If you would like the :attribute portion of your validation message to be replaced with a custom value, you may specify the custom attribute name in the attributes array of your lang/xx/validation.php language file:

1'attributes' => [
2    'email' => 'email address',
3],
1'attributes' => [
2    'email' => 'email address',
3],

[!WARNING]
By default, the Laravel application skeleton does not include the lang directory. If you would like to customize Laravel's language files, you may publish them via the lang:publish Artisan command.

Specifying Values in Language Files

Some of Laravel's built-in validation rule error messages contain a :value placeholder that is replaced with the current value of the request attribute. However, you may occasionally need the :value portion of your validation message to be replaced with a custom representation of the value. For example, consider the following rule that specifies that a credit card number is required if the payment_type has a value of cc:

1Validator::make($request->all(), [
2    'credit_card_number' => 'required_if:payment_type,cc'
3]);
1Validator::make($request->all(), [
2    'credit_card_number' => 'required_if:payment_type,cc'
3]);

If this validation rule fails, it will produce the following error message:

1The credit card number field is required when payment type is cc.
1The credit card number field is required when payment type is cc.

Instead of displaying cc as the payment type value, you may specify a more user-friendly value representation in your lang/xx/validation.php language file by defining a values array:

1'values' => [
2    'payment_type' => [
3        'cc' => 'credit card'
4    ],
5],
1'values' => [
2    'payment_type' => [
3        'cc' => 'credit card'
4    ],
5],

[!WARNING]
By default, the Laravel application skeleton does not include the lang directory. If you would like to customize Laravel's language files, you may publish them via the lang:publish Artisan command.

After defining this value, the validation rule will produce the following error message:

1The credit card number field is required when payment type is credit card.
1The credit card number field is required when payment type is credit card.

Available Validation Rules

Below is a list of all available validation rules and their function:

accepted

The field under validation must be "yes", "on", 1, "1", true, or "true". This is useful for validating "Terms of Service" acceptance or similar fields.

accepted_if:anotherfield,value,...

The field under validation must be "yes", "on", 1, "1", true, or "true" if another field under validation is equal to a specified value. This is useful for validating "Terms of Service" acceptance or similar fields.

active_url

The field under validation must have a valid A or AAAA record according to the dns_get_record PHP function. The hostname of the provided URL is extracted using the parse_url PHP function before being passed to dns_get_record.

after:date

The field under validation must be a value after a given date. The dates will be passed into the strtotime PHP function in order to be converted to a valid DateTime instance:

1'start_date' => 'required|date|after:tomorrow'
1'start_date' => 'required|date|after:tomorrow'

Instead of passing a date string to be evaluated by strtotime, you may specify another field to compare against the date:

1'finish_date' => 'required|date|after:start_date'
1'finish_date' => 'required|date|after:start_date'

after_or_equal:date

The field under validation must be a value after or equal to the given date. For more information, see the after rule.

alpha

The field under validation must be entirely Unicode alphabetic characters contained in \p{L} and \p{M}.

To restrict this validation rule to characters in the ASCII range (a-z and A-Z), you may provide the ascii option to the validation rule:

1'username' => 'alpha:ascii',
1'username' => 'alpha:ascii',

alpha_dash

The field under validation must be entirely Unicode alpha-numeric characters contained in \p{L}, \p{M}, \p{N}, as well as ASCII dashes (-) and ASCII underscores (_).

To restrict this validation rule to characters in the ASCII range (a-z and A-Z), you may provide the ascii option to the validation rule:

1'username' => 'alpha_dash:ascii',
1'username' => 'alpha_dash:ascii',

alpha_num

The field under validation must be entirely Unicode alpha-numeric characters contained in \p{L}, \p{M}, and \p{N}.

To restrict this validation rule to characters in the ASCII range (a-z and A-Z), you may provide the ascii option to the validation rule:

1'username' => 'alpha_num:ascii',
1'username' => 'alpha_num:ascii',

array

The field under validation must be a PHP array.

When additional values are provided to the array rule, each key in the input array must be present within the list of values provided to the rule. In the following example, the admin key in the input array is invalid since it is not contained in the list of values provided to the array rule:

 1use Illuminate\Support\Facades\Validator;
 2 
 3$input = [
 4    'user' => [
 5        'name' => 'Taylor Otwell',
 6        'username' => 'taylorotwell',
 7        'admin' => true,
 8    ],
 9];
10 
11Validator::make($input, [
12    'user' => 'array:name,username',
13]);
 1use Illuminate\Support\Facades\Validator;
 2 
 3$input = [
 4    'user' => [
 5        'name' => 'Taylor Otwell',
 6        'username' => 'taylorotwell',
 7        'admin' => true,
 8    ],
 9];
10 
11Validator::make($input, [
12    'user' => 'array:name,username',
13]);

In general, you should always specify the array keys that are allowed to be present within your array.

ascii

The field under validation must be entirely 7-bit ASCII characters.

bail

Stop running validation rules for the field after the first validation failure.

While the bail rule will only stop validating a specific field when it encounters a validation failure, the stopOnFirstFailure method will inform the validator that it should stop validating all attributes once a single validation failure has occurred:

1if ($validator->stopOnFirstFailure()->fails()) {
2    // ...
3}
1if ($validator->stopOnFirstFailure()->fails()) {
2    // ...
3}

before:date

The field under validation must be a value preceding the given date. The dates will be passed into the PHP strtotime function in order to be converted into a valid DateTime instance. In addition, like the after rule, the name of another field under validation may be supplied as the value of date.

before_or_equal:date

The field under validation must be a value preceding or equal to the given date. The dates will be passed into the PHP strtotime function in order to be converted into a valid DateTime instance. In addition, like the after rule, the name of another field under validation may be supplied as the value of date.

between:min,max

The field under validation must have a size between the given min and max (inclusive). Strings, numerics, arrays, and files are evaluated in the same fashion as the size rule.

boolean

The field under validation must be able to be cast as a boolean. Accepted input are true, false, 1, 0, "1", and "0".

confirmed

The field under validation must have a matching field of {field}_confirmation. For example, if the field under validation is password, a matching password_confirmation field must be present in the input.

current_password

The field under validation must match the authenticated user's password. You may specify an authentication guard using the rule's first parameter:

1'password' => 'current_password:api'
1'password' => 'current_password:api'

date

The field under validation must be a valid, non-relative date according to the strtotime PHP function.

date_equals:date

The field under validation must be equal to the given date. The dates will be passed into the PHP strtotime function in order to be converted into a valid DateTime instance.

date_format:format,...

The field under validation must match one of the given formats. You should use either date or date_format when validating a field, not both. This validation rule supports all formats supported by PHP's DateTime class.

decimal:min,max

The field under validation must be numeric and must contain the specified number of decimal places:

1// Must have exactly two decimal places (9.99)...
2'price' => 'decimal:2'
3 
4// Must have between 2 and 4 decimal places...
5'price' => 'decimal:2,4'
1// Must have exactly two decimal places (9.99)...
2'price' => 'decimal:2'
3 
4// Must have between 2 and 4 decimal places...
5'price' => 'decimal:2,4'

declined

The field under validation must be "no", "off", 0, "0", false, or "false".

declined_if:anotherfield,value,...

The field under validation must be "no", "off", 0, "0", false, or "false" if another field under validation is equal to a specified value.

different:field

The field under validation must have a different value than field.

digits:value

The integer under validation must have an exact length of value.

digits_between:min,max

The integer validation must have a length between the given min and max.

dimensions

The file under validation must be an image meeting the dimension constraints as specified by the rule's parameters:

1'avatar' => 'dimensions:min_width=100,min_height=200'
1'avatar' => 'dimensions:min_width=100,min_height=200'

Available constraints are: min_width, max_width, min_height, max_height, width, height, ratio.

A ratio constraint should be represented as width divided by height. This can be specified either by a fraction like 3/2 or a float like 1.5:

1'avatar' => 'dimensions:ratio=3/2'
1'avatar' => 'dimensions:ratio=3/2'

Since this rule requires several arguments, you may use the Rule::dimensions method to fluently construct the rule:

1use Illuminate\Support\Facades\Validator;
2use Illuminate\Validation\Rule;
3 
4Validator::make($data, [
5    'avatar' => [
6        'required',
7        Rule::dimensions()->maxWidth(1000)->maxHeight(500)->ratio(3 / 2),
8    ],
9]);
1use Illuminate\Support\Facades\Validator;
2use Illuminate\Validation\Rule;
3 
4Validator::make($data, [
5    'avatar' => [
6        'required',
7        Rule::dimensions()->maxWidth(1000)->maxHeight(500)->ratio(3 / 2),
8    ],
9]);

distinct

When validating arrays, the field under validation must not have any duplicate values:

1'foo.*.id' => 'distinct'
1'foo.*.id' => 'distinct'

Distinct uses loose variable comparisons by default. To use strict comparisons, you may add the strict parameter to your validation rule definition:

1'foo.*.id' => 'distinct:strict'
1'foo.*.id' => 'distinct:strict'

You may add ignore_case to the validation rule's arguments to make the rule ignore capitalization differences:

1'foo.*.id' => 'distinct:ignore_case'
1'foo.*.id' => 'distinct:ignore_case'

doesnt_start_with:foo,bar,...

The field under validation must not start with one of the given values.

doesnt_end_with:foo,bar,...

The field under validation must not end with one of the given values.

email

The field under validation must be formatted as an email address. This validation rule utilizes the egulias/email-validator package for validating the email address. By default, the RFCValidation validator is applied, but you can apply other validation styles as well:

1'email' => 'email:rfc,dns'
1'email' => 'email:rfc,dns'

The example above will apply the RFCValidation and DNSCheckValidation validations. Here's a full list of validation styles you can apply:

The filter validator, which uses PHP's filter_var function, ships with Laravel and was Laravel's default email validation behavior prior to Laravel version 5.8.

[!WARNING]
The dns and spoof validators require the PHP intl extension.

ends_with:foo,bar,...

The field under validation must end with one of the given values.

enum

The Enum rule is a class based rule that validates whether the field under validation contains a valid enum value. The Enum rule accepts the name of the enum as its only constructor argument. When validating primitive values, a backed Enum should be provided to the Enum rule:

1use App\Enums\ServerStatus;
2use Illuminate\Validation\Rule;
3 
4$request->validate([
5    'status' => [Rule::enum(ServerStatus::class)],
6]);
1use App\Enums\ServerStatus;
2use Illuminate\Validation\Rule;
3 
4$request->validate([
5    'status' => [Rule::enum(ServerStatus::class)],
6]);

The Enum rule's only and except methods may be used to limit which enum cases should be considered valid:

1Rule::enum(ServerStatus::class)
2    ->only([ServerStatus::Pending, ServerStatus::Active]);
3 
4Rule::enum(ServerStatus::class)
5    ->except([ServerStatus::Pending, ServerStatus::Active]);
1Rule::enum(ServerStatus::class)
2    ->only([ServerStatus::Pending, ServerStatus::Active]);
3 
4Rule::enum(ServerStatus::class)
5    ->except([ServerStatus::Pending, ServerStatus::Active]);

The when method may be used to conditionally modify the Enum rule:

1use Illuminate\Support\Facades\Auth;
2use Illuminate\Validation\Rule;
3 
4Rule::enum(ServerStatus::class)
5    ->when(
6        Auth::user()->isAdmin(),
7        fn ($rule) => $rule->only(...),
8        fn ($rule) => $rule->only(...),
9    );
1use Illuminate\Support\Facades\Auth;
2use Illuminate\Validation\Rule;
3 
4Rule::enum(ServerStatus::class)
5    ->when(
6        Auth::user()->isAdmin(),
7        fn ($rule) => $rule->only(...),
8        fn ($rule) => $rule->only(...),
9    );

exclude

The field under validation will be excluded from the request data returned by the validate and validated methods.

exclude_if:anotherfield,value

The field under validation will be excluded from the request data returned by the validate and validated methods if the anotherfield field is equal to value.

If complex conditional exclusion logic is required, you may utilize the Rule::excludeIf method. This method accepts a boolean or a closure. When given a closure, the closure should return true or false to indicate if the field under validation should be excluded:

 1use Illuminate\Support\Facades\Validator;
 2use Illuminate\Validation\Rule;
 3 
 4Validator::make($request->all(), [
 5    'role_id' => Rule::excludeIf($request->user()->is_admin),
 6]);
 7 
 8Validator::make($request->all(), [
 9    'role_id' => Rule::excludeIf(fn () => $request->user()->is_admin),
10]);
 1use Illuminate\Support\Facades\Validator;
 2use Illuminate\Validation\Rule;
 3 
 4Validator::make($request->all(), [
 5    'role_id' => Rule::excludeIf($request->user()->is_admin),
 6]);
 7 
 8Validator::make($request->all(), [
 9    'role_id' => Rule::excludeIf(fn () => $request->user()->is_admin),
10]);

exclude_unless:anotherfield,value

The field under validation will be excluded from the request data returned by the validate and validated methods unless anotherfield's field is equal to value. If value is null (exclude_unless:name,null), the field under validation will be excluded unless the comparison field is null or the comparison field is missing from the request data.

exclude_with:anotherfield

The field under validation will be excluded from the request data returned by the validate and validated methods if the anotherfield field is present.

exclude_without:anotherfield

The field under validation will be excluded from the request data returned by the validate and validated methods if the anotherfield field is not present.

exists:table,column

The field under validation must exist in a given database table.

Basic Usage of Exists Rule

1'state' => 'exists:states'
1'state' => 'exists:states'

If the column option is not specified, the field name will be used. So, in this case, the rule will validate that the states database table contains a record with a state column value matching the request's state attribute value.

Specifying a Custom Column Name

You may explicitly specify the database column name that should be used by the validation rule by placing it after the database table name:

1'state' => 'exists:states,abbreviation'
1'state' => 'exists:states,abbreviation'

Occasionally, you may need to specify a specific database connection to be used for the exists query. You can accomplish this by prepending the connection name to the table name:

1'email' => 'exists:connection.staff,email'
1'email' => 'exists:connection.staff,email'

Instead of specifying the table name directly, you may specify the Eloquent model which should be used to determine the table name:

1'user_id' => 'exists:App\Models\User,id'
1'user_id' => 'exists:App\Models\User,id'

If you would like to customize the query executed by the validation rule, you may use the Rule class to fluently define the rule. In this example, we'll also specify the validation rules as an array instead of using the | character to delimit them:

 1use Illuminate\Database\Query\Builder;
 2use Illuminate\Support\Facades\Validator;
 3use Illuminate\Validation\Rule;
 4 
 5Validator::make($data, [
 6    'email' => [
 7        'required',
 8        Rule::exists('staff')->where(function (Builder $query) {
 9            return $query->where('account_id', 1);
10        }),
11    ],
12]);
 1use Illuminate\Database\Query\Builder;
 2use Illuminate\Support\Facades\Validator;
 3use Illuminate\Validation\Rule;
 4 
 5Validator::make($data, [
 6    'email' => [
 7        'required',
 8        Rule::exists('staff')->where(function (Builder $query) {
 9            return $query->where('account_id', 1);
10        }),
11    ],
12]);

You may explicitly specify the database column name that should be used by the exists rule generated by the Rule::exists method by providing the column name as the second argument to the exists method:

1'state' => Rule::exists('states', 'abbreviation'),
1'state' => Rule::exists('states', 'abbreviation'),

extensions:foo,bar,...

The file under validation must have a user-assigned extension corresponding to one of the listed extensions:

1'photo' => ['required', 'extensions:jpg,png'],
1'photo' => ['required', 'extensions:jpg,png'],

[!WARNING]
You should never rely on validating a file by its user-assigned extension alone. This rule should typically always be used in combination with the mimes or mimetypes rules.

file

The field under validation must be a successfully uploaded file.

filled

The field under validation must not be empty when it is present.

gt:field

The field under validation must be greater than the given field or value. The two fields must be of the same type. Strings, numerics, arrays, and files are evaluated using the same conventions as the size rule.

gte:field

The field under validation must be greater than or equal to the given field or value. The two fields must be of the same type. Strings, numerics, arrays, and files are evaluated using the same conventions as the size rule.

hex_color

The field under validation must contain a valid color value in hexadecimal format.

image

The file under validation must be an image (jpg, jpeg, png, bmp, gif, svg, or webp).

in:foo,bar,...

The field under validation must be included in the given list of values. Since this rule often requires you to implode an array, the Rule::in method may be used to fluently construct the rule:

1use Illuminate\Support\Facades\Validator;
2use Illuminate\Validation\Rule;
3 
4Validator::make($data, [
5    'zones' => [
6        'required',
7        Rule::in(['first-zone', 'second-zone']),
8    ],
9]);
1use Illuminate\Support\Facades\Validator;
2use Illuminate\Validation\Rule;
3 
4Validator::make($data, [
5    'zones' => [
6        'required',
7        Rule::in(['first-zone', 'second-zone']),
8    ],
9]);

When the in rule is combined with the array rule, each value in the input array must be present within the list of values provided to the in rule. In the following example, the LAS airport code in the input array is invalid since it is not contained in the list of airports provided to the in rule:

 1use Illuminate\Support\Facades\Validator;
 2use Illuminate\Validation\Rule;
 3 
 4$input = [
 5    'airports' => ['NYC', 'LAS'],
 6];
 7 
 8Validator::make($input, [
 9    'airports' => [
10        'required',
11        'array',
12    ],
13    'airports.*' => Rule::in(['NYC', 'LIT']),
14]);
 1use Illuminate\Support\Facades\Validator;
 2use Illuminate\Validation\Rule;
 3 
 4$input = [
 5    'airports' => ['NYC', 'LAS'],
 6];
 7 
 8Validator::make($input, [
 9    'airports' => [
10        'required',
11        'array',
12    ],
13    'airports.*' => Rule::in(['NYC', 'LIT']),
14]);

in_array:anotherfield.*

The field under validation must exist in anotherfield's values.

integer

The field under validation must be an integer.

[!WARNING]
This validation rule does not verify that the input is of the "integer" variable type, only that the input is of a type accepted by PHP's FILTER_VALIDATE_INT rule. If you need to validate the input as being a number please use this rule in combination with the numeric validation rule.

ip

The field under validation must be an IP address.

ipv4

The field under validation must be an IPv4 address.

ipv6

The field under validation must be an IPv6 address.

json

The field under validation must be a valid JSON string.

lt:field

The field under validation must be less than the given field. The two fields must be of the same type. Strings, numerics, arrays, and files are evaluated using the same conventions as the size rule.

lte:field

The field under validation must be less than or equal to the given field. The two fields must be of the same type. Strings, numerics, arrays, and files are evaluated using the same conventions as the size rule.

lowercase

The field under validation must be lowercase.

mac_address

The field under validation must be a MAC address.

max:value

The field under validation must be less than or equal to a maximum value. Strings, numerics, arrays, and files are evaluated in the same fashion as the size rule.

max_digits:value

The integer under validation must have a maximum length of value.

mimetypes:text/plain,...

The file under validation must match one of the given MIME types:

1'video' => 'mimetypes:video/avi,video/mpeg,video/quicktime'
1'video' => 'mimetypes:video/avi,video/mpeg,video/quicktime'

To determine the MIME type of the uploaded file, the file's contents will be read and the framework will attempt to guess the MIME type, which may be different from the client's provided MIME type.

mimes:foo,bar,...

The file under validation must have a MIME type corresponding to one of the listed extensions:

1'photo' => 'mimes:jpg,bmp,png'
1'photo' => 'mimes:jpg,bmp,png'

Even though you only need to specify the extensions, this rule actually validates the MIME type of the file by reading the file's contents and guessing its MIME type. A full listing of MIME types and their corresponding extensions may be found at the following location:

https://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/mime.types

MIME Types and Extensions

This validation rule does not verify agreement between the MIME type and the extension the user assigned to the file. For example, the mimes:png validation rule would consider a file containing valid PNG content to be a valid PNG image, even if the file is named photo.txt. If you would like to validate the user-assigned extension of the file, you may use the extensions rule.

min:value

The field under validation must have a minimum value. Strings, numerics, arrays, and files are evaluated in the same fashion as the size rule.

min_digits:value

The integer under validation must have a minimum length of value.

multiple_of:value

The field under validation must be a multiple of value.

missing

The field under validation must not be present in the input data.

missing_if:anotherfield,value,...

The field under validation must not be present if the anotherfield field is equal to any value.

missing_unless:anotherfield,value

The field under validation must not be present unless the anotherfield field is equal to any value.

missing_with:foo,bar,...

The field under validation must not be present only if any of the other specified fields are present.

missing_with_all:foo,bar,...

The field under validation must not be present only if all of the other specified fields are present.

not_in:foo,bar,...

The field under validation must not be included in the given list of values. The Rule::notIn method may be used to fluently construct the rule:

1use Illuminate\Validation\Rule;
2 
3Validator::make($data, [
4    'toppings' => [
5        'required',
6        Rule::notIn(['sprinkles', 'cherries']),
7    ],
8]);
1use Illuminate\Validation\Rule;
2 
3Validator::make($data, [
4    'toppings' => [
5        'required',
6        Rule::notIn(['sprinkles', 'cherries']),
7    ],
8]);

not_regex:pattern

The field under validation must not match the given regular expression.

Internally, this rule uses the PHP preg_match function. The pattern specified should obey the same formatting required by preg_match and thus also include valid delimiters. For example: 'email' => 'not_regex:/^.+$/i'.

[!WARNING]
When using the regex / not_regex patterns, it may be necessary to specify your validation rules using an array instead of using | delimiters, especially if the regular expression contains a | character.

nullable

The field under validation may be null.

numeric

The field under validation must be numeric.

present

The field under validation must exist in the input data.

present_if:anotherfield,value,...

The field under validation must be present if the anotherfield field is equal to any value.

present_unless:anotherfield,value

The field under validation must be present unless the anotherfield field is equal to any value.

present_with:foo,bar,...

The field under validation must be present only if any of the other specified fields are present.

present_with_all:foo,bar,...

The field under validation must be present only if all of the other specified fields are present.

prohibited

The field under validation must be missing or empty. A field is "empty" if it meets one of the following criteria:

prohibited_if:anotherfield,value,...

The field under validation must be missing or empty if the anotherfield field is equal to any value. A field is "empty" if it meets one of the following criteria:

If complex conditional prohibition logic is required, you may utilize the Rule::prohibitedIf method. This method accepts a boolean or a closure. When given a closure, the closure should return true or false to indicate if the field under validation should be prohibited:

 1use Illuminate\Support\Facades\Validator;
 2use Illuminate\Validation\Rule;
 3 
 4Validator::make($request->all(), [
 5    'role_id' => Rule::prohibitedIf($request->user()->is_admin),
 6]);
 7 
 8Validator::make($request->all(), [
 9    'role_id' => Rule::prohibitedIf(fn () => $request->user()->is_admin),
10]);
 1use Illuminate\Support\Facades\Validator;
 2use Illuminate\Validation\Rule;
 3 
 4Validator::make($request->all(), [
 5    'role_id' => Rule::prohibitedIf($request->user()->is_admin),
 6]);
 7 
 8Validator::make($request->all(), [
 9    'role_id' => Rule::prohibitedIf(fn () => $request->user()->is_admin),
10]);

prohibited_unless:anotherfield,value,...

The field under validation must be missing or empty unless the anotherfield field is equal to any value. A field is "empty" if it meets one of the following criteria:

prohibits:anotherfield,...

If the field under validation is not missing or empty, all fields in anotherfield must be missing or empty. A field is "empty" if it meets one of the following criteria:

regex:pattern

The field under validation must match the given regular expression.

Internally, this rule uses the PHP preg_match function. The pattern specified should obey the same formatting required by preg_match and thus also include valid delimiters. For example: 'email' => 'regex:/^.+@.+$/i'.

[!WARNING]
When using the regex / not_regex patterns, it may be necessary to specify rules in an array instead of using | delimiters, especially if the regular expression contains a | character.

required

The field under validation must be present in the input data and not empty. A field is "empty" if it meets one of the following criteria:

required_if:anotherfield,value,...

The field under validation must be present and not empty if the anotherfield field is equal to any value.

If you would like to construct a more complex condition for the required_if rule, you may use the Rule::requiredIf method. This method accepts a boolean or a closure. When passed a closure, the closure should return true or false to indicate if the field under validation is required:

 1use Illuminate\Support\Facades\Validator;
 2use Illuminate\Validation\Rule;
 3 
 4Validator::make($request->all(), [
 5    'role_id' => Rule::requiredIf($request->user()->is_admin),
 6]);
 7 
 8Validator::make($request->all(), [
 9    'role_id' => Rule::requiredIf(fn () => $request->user()->is_admin),
10]);
 1use Illuminate\Support\Facades\Validator;
 2use Illuminate\Validation\Rule;
 3 
 4Validator::make($request->all(), [
 5    'role_id' => Rule::requiredIf($request->user()->is_admin),
 6]);
 7 
 8Validator::make($request->all(), [
 9    'role_id' => Rule::requiredIf(fn () => $request->user()->is_admin),
10]);