How to validate URL query parameters?

Look into using Form Requests to validate your inbound form requests before you need to do any logic.

https://laravel.com/docs/5.8/validation

How to validate URL query parameters?

For one thing, these parameters remain the same unless user changes something in the address bar.

In other words they are original derived from the controller and passed in the appends method.

In a case where a user does try to change something, like an edit where the id = 5 and say they change it to 15, that's where RBAC comes in, it prevents it.

But you could do the following, because I am not sure.

Research and see if laravel auto runs query parameters through PHP htmlspecialchars. If not you could do it yourself.

And you could validate the query string parameters, I've just never seen that as a concern. Usually the query string doesn't have secure data, for security use post and put.

month=''''''&year=

Set some defaults in the request like:

$page = Request::input('page', '1');

Default = 1. Or handle in a ternary statement:

$dogsearch = !empty(Request::input('psch')) ? Request::input('psch') : '';

Just example, handle your blanks in your ternary.

Just check how exactly you pass the request fields to the scope.

@SNAPEY - I pass the request fields to the scope the way it is shown in the video, that is:

->filter(request(['month','year']))

this raises a Notice error (undefined index) if there is no "/posts?month=April" or no "/posts?month=&aaa=bbb" in the URL. The page "/posts" will raise the error.

However, it does somehow work if I put this instead:

->filter(request())

Why? I don't like sending a big fat request() to the scope.

in the first case, where I go to "/posts", it raises an error since 'month' is null, but in the second case it works fine (eventhough 'month' is null as well) and skips the scope's if condition fine.

bump

Usually I just replace the all method in the FormRequest like this

	public function all($keys = null)
	{
	  $request = parent::all($keys);

	  $request['my_query_param'] = $this->route('my_query_param');

	  return $request;
	}

then I can use "my_query_param" in the rules method as any other incoming request input value.

This is my solution based on this cases:

sample url:

• url/{screenerId}?filter[compliancy]=abc

    public function all($keys = null)
    {
        $request = parent::all($keys);

        $request['screenerId'] =  $this->route('screenerId');

        if (isset($request['filter']['compliancy'])) {
            $request['compliancy'] =  $request['filter']['compliancy'];
        }

        return $request;
    }

Rules i had:

public function rules(): array
    {
        return [
            'screenerId'   => ['required'],
            'compliancy' => ['sometimes', Rule::in(['abc', 'def'])],
        ];
    }