Laravel Form Validation: The Core Rules With Examples

Laravel's validator covers the large majority of real form-validation needs with a compact rule syntax — most forms only need a handful of these rules combined.

Inline validation in a controller

$validated = $request->validate([
    'name' => ['required', 'string', 'max:255'],
    'email' => ['required', 'email:rfc', 'unique:users,email'],
    'password' => ['required', 'min:8', 'confirmed'],
    'age' => ['nullable', 'integer', 'min:18'],
]);

The rules that cover most cases

• required / nullable — whether the field must be present at all
• string / integer / numeric / boolean — basic type checks
• min: / max: — for strings, this is character length; for numbers, it's the value itself; for arrays, it's item count — the same rule name means different things depending on the field's other type rule
• email:rfc — validates email format; the rfc variant is the standard choice, other variants exist for stricter DNS/mailbox checks
• unique:table,column — checks the database for an existing value, essential for things like email or username fields
• confirmed — expects a matching _confirmation field (e.g. password_confirmation) and fails if they don't match

Custom error messages

$request->validate([
    'email' => 'required|email',
], [
    'email.required' => 'Please enter your email address.',
    'email.email' => 'That doesn\'t look like a valid email.',
]);

Moving validation into a Form Request

For anything beyond a trivial form, a dedicated Form Request class keeps the controller focused on orchestration:

php artisan make:request StoreUserRequest

class StoreUserRequest extends FormRequest
{
    public function authorize(): bool
    {
        return true;
    }

    public function rules(): array
    {
        return [
            'name' => ['required', 'string', 'max:255'],
            'email' => ['required', 'email', 'unique:users,email'],
        ];
    }
}

public function store(StoreUserRequest $request)
{
    $validated = $request->validated();
}

Laravel automatically runs the Form Request's validation before the controller method executes — if it fails, the request never reaches your controller code at all, and the user is redirected back with errors.