TOPIC
The confirmed rule has one specific, easy-to-miss requirement: the confirmation field must be named exactly {field}_confirmation, or the rule silently never matches anything.
The native Constraint Validation API — setCustomValidity() specifically — lets a browser show its own built-in validation message for a custom check like password matching, without a framework.
A plain unique rule breaks in two common situations — editing a record without triggering a false "already taken" error against itself, and soft-deleted rows still counting as taken.
A direct reCAPTCHA v3 integration — verify the token server-side against Google's API yourself, rather than depending on a third-party wrapper package that may or may not still be maintained.
A working example of uploading an image via AJAX in Laravel with a live browser preview before the request is sent, using FormData and the public disk.
The dot-notation syntax for validating each item in an array field, and the * wildcard for a variable-length list — like a form that lets someone add multiple items dynamically.
The mimes, max, and dimensions validation rules for file uploads, and why validating the file extension alone is not a real security check.
Validators.required and friends cover the basics — the parts that actually trip people up are writing a custom validator function and validating one field against another.
required, min/max, email, and unique — the validation rules that cover most real forms, plus the Form Request pattern for keeping validation out of the controller.
$_GET, $_POST, and $_REQUEST are not interchangeable — the practical difference is where the data comes from, and why $_REQUEST is usually the wrong default choice.
