Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.
I've followed the simple steps in the Validation documentation:
The controller method gets called with a FeedbackFormRequest, but a) no validation is performed, and b) it is entirely empty. Accessing all() or get($name) returns null for everything, and using dd() shows an empty request. Returning false from authorized() also has no effect.
So while it seems the custom request is completely ignored, $request is an instance of the custom request in the controller. If I change the constructor method declaration to take Request instead, the form values are present. Changing to a named controller method has no effect.
What could I be missing?
class FeedbackFormRequest extends FormRequest
{
public function authorize(): bool {
return true;
}
public function rules(): array {
return [
'name' => 'required|max=100',
'email' => 'required|email|max=100',
'subject' => 'required|max=100',
'body' => 'required|max=750',
'url' => 'max=200',
'g-recaptcha-response' => 'required|recaptcha',
];
}
}
public function __invoke(FeedbackFormRequest $request) {
$name = $request->get('name');
$subject = $request->get('subject');
return 'Thank you, ' . $name . ', for your message about ' . $subject . '.';
}
it looks pretty clean. maybe you will try like this
public function rules()
{
return [
'name' => 'required|max=100',
'email' => 'required|email|max=100',
'subject' => 'required|max=100',
'body' => 'required|max=750',
'url' => 'max=200',
'g-recaptcha-response' => 'required|recaptcha',
];
}
Let me see your form
Why are you doing this in the __invoke method?
I'm using single-action controllers for the most part, so you use __invoke() and don't add "@method" to the route. I switched to a named method and put the route into web.php instead of api.php with no change in behavior.
Sure, here's the form blade template:
<form action="/api/submit-feedback" method="post">
<label for="name">Name</label>
<input type="text" id="name" name="name" maxlength="100" autofocus>
<label for="email">Email</label>
<input type="email" id="email" name="email" maxlength="100">
<label for="subject">Subject</label>
<input type="text" id="subject" name="subject" maxlength="100">
<br>
<label for="body">Your Message (max 750 characters)</label>
<br>
<textarea id="body" name="body" maxlength="750"></textarea>
<br>
<label for="feedback-url">URL</label>
<input type="text" id="feedback-url" name="url" maxlength="200">
<script>
document.getElementById('feedback-url').value = document.referrer;
</script>
{!! Recaptcha::render() !!}
<button id="submit" type="submit">Submit Message</button>
</form>
remove the = signs in your rules and replace with a colon. You're doing max=200 in several places when it should be max:200.
@Cronix Thanks. I replace them all with no result. I then removed all the rules and returned an empty array, again no change. I'd expect an exception if the rules were malformed, and indeed I changed one rule to "slug" with no change or error message.
Laravel is instantiating my custom request but completely ignoring the overridden methods. It subclasses Illuminate\Foundation\Http\FormRequest, but adding debug code to the validation method in the parent class doesn't trigger. It looks like Laravel simply instantiates whatever is listed in the controller's method but doesn't actually use it unless it's the built-in generic Request.
I had to enable FoundationServiceProvider which required enabling SessionServiceProvider which I was really hoping to avoid since we aren't using PHP sessions. C'est la vie!
Why? Because we don't use Redis or Authentication or Mail or Notifications or the Bus or Broadcasting, and I'm trying to minimize the number of unknowns we need to track down when problems arise.
how are you determining that nothing is passed?
does it work ok if you switch your form request for Request
The api routes dont use sessions?
what happens when you manually validate in the controller? if that works you COULD extract that to another file (call it whateverRequest) and pass in Request and do the whole test if it passes validation manually..
Please or to participate in this conversation.