Safely Accessing Request Data After Laravel Validation

When a client sends a request to a Laravel controller, the request holds the submitted values. Laravel’s validator checks those values against rules you set. After it checks them, pass the validated values to updates and other code that should receive only input covered by the rules. $request->validated() returns an array of those values. $request->all() and $request->only() read values from the request.

Selecting a field alone does not prove it passed validation. Use validated() or select from $request->safe() to keep unvalidated request values out of downstream code.

What all(), only(), and validated() return

$request->all() returns the request’s input, including input that validation rules do not cover. Laravel documents request-level only() as a way to select named keys from the request input. Selecting a key does not check whether its value passed validation.

By contrast, $request->validated() returns the values covered by the validation rules. $request->safe() returns an object containing the validated values. Call all() on that object to get all the validated data, or call only([...]) to select some of it. Laravel describes these methods in its validation documentation.

The object you call only() on determines which data it selects. A FormRequest is also an HTTP request, so $request->only([...]) selects request input. Laravel’s FormRequest class extends the request class. To select only validated fields, call only() on the object returned by safe().

Pass validated data to updates

Keep the data boundary clear in the controller: store the validator’s result and pass it to the update:

public function update(UpdateUserRequest $request, User $user)
{
    $validated = $request->validated();

    $user->update($validated);
}

To update only some validated fields, select them from the safe-input object:

$data = $request->safe()->only(['name', 'email']);

$user->update($data);

Do not pass $request->all() or $request->only([...]) to code that saves data when you intend to save only validated values. Laravel also recommends configuring model $fillable or $guarded properties and saving trusted input. Validation checks whether submitted values meet the rules. It does not grant permission to change a record or guarantee that every business rule has been met.

Allow only expected keys in nested arrays

When a request field contains an array, a group of key-value pairs, validate both the expected fields and the keys the array may contain. For example, a form request can define:

public function rules(): array
{
    return [
        'profile' => ['required', 'array:name,email'],
        'profile.name' => ['required', 'string'],
        'profile.email' => ['required', 'email'],
    ];
}

The array:name,email rule limits the profile array to those keys. Then select the validated array in the controller:

$profile = $request->safe()->only(['profile']);

Laravel’s current validation documentation warns that nested arrays can contain keys with no validation rules of their own unless you specify which keys the array may contain. Laravel’s 9.x upgrade guide describes a different default for array keys without validation rules in that version. Because the documented behavior depends on the Laravel version, explicitly listing allowed keys makes the accepted array structure clear.

What I'm building

Delegate tasks. Get software.

Give Vroni a GitHub issue, bug report, spec, or rough idea. It reads the repo, plans the change, writes code, runs checks, and works toward a review-ready pull request.

Take a look at vroni.com