> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: Validating Array Inputs
- URL: https://securinglaravel.com/security-tip-validating-array-inputs/
- Published: 2023-04-07T14:01:49.000Z
- Updated: 2025-01-28T02:15:02.000Z
- Description: [Tip#42] Validating single values is easy, but what about arrays?
- Author: Stephen Rees-Carter
- Tags: Security Tips, Audits Top 10, Input Validation, Mass-Assignment

ℹ️

**This is part of my series on the* [**Top 10 Security Issues*](https://securinglaravel.com/tag/audits-top-10/) *discovered during my Laravel Security Audits, as of April 2023\.*   
  
**#1 →* [**Exposed API Keys & Passwords*](https://securinglaravel.com/in-depth-storing-environment-variables/)  
**#2 →* [**Missing Authorisation*](https://securinglaravel.com/security-tip-test-for-missing-authorisation/)  
**#3 →* [**Missing Content Security Policy (CSP)*](https://securinglaravel.com/security-tip-getting-started-with-csp/)  
**#4 →* [**Missing Security Headers*](https://securinglaravel.com/security-tip-security-headers-are/)  
**#5 →* [**Insecure Function Use*](https://securinglaravel.com/in-depth-what-are-insecure-functions/)  
**#6 →* [**Outdated & Vulnerable Dependencies*](https://securinglaravel.com/security-tip-replace-simple-dependencies/)  
**#7 →* [**Cross-Site Scripting (XSS)*](https://securinglaravel.com/security-tip-avoiding-xss-with-htmlstring/)  
**#8 →* [**Insufficient Rate Limiting*](https://securinglaravel.com/security-tip-dont-forget-rate-limiting/)  
**#9 →* [**Missing Subresource Integrity (SRI)*](https://securinglaravel.com/security-tip-subresource-integrity/)  
***#10 → Insufficient Input Validation &** [***Mass-Assignment Vulnerabilities**](https://securinglaravel.com/in-depth-mass-assignment-vulnerabilities/)

A common excuse for not validating inputs is *complexity*.

When building a complicated interface, it’s easy to get overwhelmed by the number of inputs your passing around, and then adding in arrays - and nested arrays - just bumps up the complexity significantly.

As a developer, I totally get it. I’ve done the same! But as a security person, and a hacker, I see opportunities to inject stuff! 😈

When attacking a form (during an audit), I specifically go looking for nested array inputs, and then see what I can inject into them. I look for sensitive columns, such as `users.admin`, and see what it’ll accept. Nested and related models are gold for this, as they are often blindly synced in batch, rather than carefully checked individually.

**So how should you validate array inputs?**

There are a few options, depending on what you need to do. Let’s take a look at each in turn.

1. `array` **validation rule.**  
It allows you to specify which fields must be present in the input array.  
```  
$input = [  
    'user' => [  
        'name'  => 'Frodo Baggins',  
        'sword' => 'Sting',  
        'ring'  => true,  
    ],  
];  
   
$request->validate([  
    'user' => 'array:name,sword,ring',  
]);.  
```
2. **Simple dot-notation for nested values.**  
Like elsewhere in Laravel, you can use dot-notation to traverse arrays, and assign unique rules to each array item. This is a great approach for ensuring each value is properly validated.  
```  
$input = [  
    'user' => [  
        'name'  => 'Frodo Baggins',  
        'sword' => 'Sting',  
        'ring'  => true,  
    ],  
];  
   
$request->validate([  
    'user.name'  => 'required|string',  
    'user.sword' => 'nullable|string',  
    'user.ring'  => 'required|boolean',  
]);.  
```
3. **Wildcard dot-notation for nested arrays.**  
When dealing with arrays of items nested under a key, you can use the `` `*` `` wildcard to easily validate the keys within the array items.  
```  
$input = [  
    'users' => [  
        ['name' => 'Frodo Baggins', 'sword' => 'Sting', 'ring' => true],  
        ['name' => 'Gollum', 'sword' => null, 'ring' => false],  
    ],  
];  
   
$request->validate([  
    'users.*.name'  => 'required|string',  
    'users.*.sword' => 'nullable|string',  
    'users.*.ring'  => 'required|boolean',  
]);.  
```

---

***If you found this security tip useful,*** [***subscribe***](#/portal/signup) ***to get weekly*** [***Security Tips***](https://securinglaravel.com/tag/tips/) **straight to your inbox.* Upgrade to a* [*premium subscription*](#/portal/signup) *for exclusive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*, or drop a coin in the* [*tip jar*](#/portal/support) *to show your support.*

*When was the last time you had a penetration test? Book a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com)*, or a budget-friendly* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*!* 

*You can also connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*, and check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*