> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: Don’t Trust User Input!
- URL: https://securinglaravel.com/security-tip-validating-user-input/
- Published: 2021-11-08T22:00:36.000Z
- Updated: 2024-09-23T12:06:34.000Z
- Description: [Tip #7] Always pass user input through a validator to ensure you only get the data you're expecting.
- Author: Stephen Rees-Carter
- Tags: Security Tips, Input Validation, Validation

**Don’t trust user input.**

**Don’t trust user input.**

*And one more for good measure…*

**Don’t trust user input.**

You should always pass user input through a validator before you use it, and here are a few reasons why:

1. It forces you to define explicit rules which state exactly what sort of input is allowed in each field.
2. You’re far less likely to have unexpected data that causes your application to do [unexpected things](https://securinglaravel.com/tag/vulnerabilities/).
3. You have control over which fields are passed into a model for [mass-assignment](https://securinglaravel.com/tag/mass-assignment/).
4. Your user interface can understand and display friendly errors to your users with minimal effort on your part.
5. [Cross-Site Scripting (XSS)](https://securinglaravel.com/tag/xss/)
6. [SQL Injection (SQLi)](https://securinglaravel.com/tag/sqli/)
7. And more...

[Check out the docs for the many ways to use a validator in Laravel.](https://laravel.com/docs/validation?ref=securinglaravel.com)

My preferred method is within [controller actions](https://laravel.com/docs/validation?ref=securinglaravel.com#quick-writing-the-validation-logic) on the `Request` object, or using a [FormRequest object](https://laravel.com/docs/validation?ref=securinglaravel.com#form-request-validation) for more complicated forms.

```
/**
 * Store a new blog post.
 *
 * @param  \Illuminate\Http\Request  $request
 * @return \Illuminate\Http\Response
 */
public function store(Request $request)
{
    $validated = $request->validate([
        'title'      => ['required', 'unique:posts', 'max:255'],
        'body'       => ['required', 'string'],
        'publish_at' => ['nullable', 'date'],
    ]);

    // $validated contains only valid user input

    $post = Post::create($validated);

    // ...
}
```

Go forth and validate all the things! 😎

---

**Found this security tip helpful?* Don't forget to* [*subscribe*](https://securinglaravel.com/#/portal/signup) *to receive new* [*Security Tips*](https://securinglaravel.com/tag/tips/) *each week, and upgrade to a* [*premium subscription*](https://securinglaravel.com/#/portal/signup) *to receive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*, or toss a coin in the* [*tip jar*](https://securinglaravel.com/#/portal/support)*.*

*Reach out if you're looking for a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com) *or a budget-friendly* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*, and find me on the various socials through* [*Pinkary*](https://pinkary.com/@valorin?ref=securinglaravel.com)*. Finally, don't forget to check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive security course.*