Originally published on laravel.learnio.dev — part of the Laravel best practices course. View this lesson on the original site.

Read input deliberately, not loosely

Laravel's request object gives one place to read query, body, and typed values. Using it consistently prevents subtle bugs in controllers.

Inject the request in your action

use Illuminate\Http\Request;

public function index(Request $request)
{
    $search = $request->input('search');
}

input() reads from the request payload and query string.

Use the right reader for each source

General input:

$search = $request->input('search', '');

Query string only:

$page = $request->query('page', 1);

Typed helpers:

$perPage = $request->integer('per_page', 20);
$includeArchived = $request->boolean('include_archived', false);

Typed helpers reduce manual casting noise.

Validate before trusting payload

Inline validation:

$data = $request->validate([
    'email' => ['required', 'email'],
    'name' => ['required', 'string', 'max:255'],
]);

With form request:

$data = $request->validated();

Work from validated data, not raw unfiltered input.

Bad way vs better way

Bad way (grab everything and pass through):

public function store(Request $request, CreateUserService $service)
{
    $service->handle($request->all());
}

Better way (validate first, then pass trusted data):

public function store(StoreUserRequest $request, CreateUserService $service)
{
    $service->handle($request->validated());
}

Why better:

  • reduces accidental mass assignment issues,
  • keeps service contracts predictable,
  • makes tests clearer about expected payload shape.

Practical request handling checklist

  • use input() for general payload access,
  • use query() for query-string-only values,
  • use typed helpers for booleans and integers,
  • validate before service calls,
  • avoid passing $request->all() into business logic.

Input flow

flowchart LR
  A[HTTP request] --> B[Request object]
  B --> C[Validate and normalise input]
  C --> D[Call service with trusted data]
  D --> E[Return response]

Next, you will apply this input handling approach to forms and validation flow in more depth.

From Laravel best practices — Routing, Controllers & Request Flow