I would prefer the first approach, as the JSON format is becoming the defacto standard for passing data between systems.
Not sure though why you think it's harder to validate? If you grab the input and call json_decode($input), you will get a proper PHP array to work with.
example:
public function show(Illuminate\Http\Request $request)
{
$data = json_decode($request->all());
}