> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: Casting Request Values
- URL: https://securinglaravel.com/security-tip-casing-request-values/
- Published: 2023-03-06T10:01:00.000Z
- Updated: 2025-01-13T08:31:32.000Z
- Description: [Tip #39] Why treat all user input as strings when you can pull out specific values and automatically cast them as the types you're expecting?
- Author: Stephen Rees-Carter
- Tags: Security Tips, Input Validation, Mass-Assignment, Workflow

Laravel’s [Request object](https://laravel.com/docs/requests?ref=securinglaravel.com) (`Illuminate\Http\Request`) includes a number of methods for extracting user input. My personal favourite is the `validate()` method (*see* [*Security Tip: Don’t Trust User Input*](https://securinglaravel.com/security-tip-validating-user-input/)), however there are a number of others you can reach for instead, depending on your use case.

Sometimes you’ll need to pull out specific request values and transform them into specific types, such as integers or Booleans. Although you can do this manually, there is always the potential to forget or rely on type juggling and for [subtle vulnerabilities](https://securinglaravel.com/security-tip-type-juggling/) to be introduced.

So instead, a safer way to do it is to ask the Request object to give you the input value in the type you need it in. It’ll return a properly typed value that you can use safely throughout your app.

The available methods are:

```
public function string($key, $default = null): \Illuminate\Support\Stringable;
public function boolean($key = null, $default = false): bool;
public function integer($key, $default = 0): int;
public function float($key, $default = 0.0): float;
public function date($key, $format = null, $tz = null): \Illuminate\Support\Carbon;
public function enum($key, $enumClass): <Enum>;
```

With the exception of `string()`, they are all pretty self-explanatory.

The `string()` method actually returns an instance of `Illuminate\Support\Stringable`, which you can easily manipulate via a [fluent interface](https://laravel.com/docs/11.x/strings?ref=securinglaravel.com#fluent-strings-method-list).

You won’t need this all the time, but it’ll save you some effort and reduce potential bugs when you do. 🙂

---

***If you found this security tip useful,*** [***subscribe***](#/portal/signup) ***to get weekly*** [***Security Tips***](https://securinglaravel.com/tag/tips/) **straight to your inbox.* Upgrade to a* [*premium subscription*](#/portal/signup) *for exclusive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*, or drop a coin in the* [*tip jar*](#/portal/support) *to show your support.*

*When was the last time you had a penetration test? Book a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com)*, or a budget-friendly* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*!* 

*You can also connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*, and check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*