How do you validate requests in Laravel? Why use Form Requests?

Summary

Use $request->validate([...]) for simple cases, or a Form Request class that holds the rules, authorization check and custom messages. On failure Laravel redirects back with errors (web) or returns a 422 JSON response (API).

Longer Answer

A Form Request (php artisan make:request StoreOrderRequest) keeps controllers thin and makes validation reusable and testable. It has rules(), authorize(), messages(), prepareForValidation() for normalising input and after() hooks for cross-field checks.

Useful rules: required, sometimes, nullable, exists:table,column, unique:table,column (with ->ignore($id) on update), Rule::in, Rule::enum, array rules with items.*.qty, File and Password rule objects, and custom rule classes.

After validation, use $request->validated() or $request->safe() so only validated fields are used. Validation does not replace database constraints: a unique rule can still race, so keep the unique index.

Code Example

class StoreOrderRequest extends FormRequest
{
    public function authorize(): bool
    {
        return $this->user()->can('create', Order::class);
    }

    public function rules(): array
    {
        return [
            'items' => ['required', 'array', 'min:1'],
            'items.*.product_id' => ['required', 'integer', 'exists:products,id'],
            'items.*.qty' => ['required', 'integer', 'between:1,100'],
        ];
    }
}

Key Points

• validate() inline or Form Request classes.
• 422 JSON for APIs, redirect with errors for web.
• Use validated() / safe() data.
• Keep database constraints; the unique rule can race.