How can I sanitize laravel Request inputs? - php

Question

I have MyRequest.php class extending App\Http\Requests\Request. I want to trim() every input before validation because an e-mail with a space after it does not pass validation.
However sanitize() was removed from src/Illuminate/Foundation/Http/FormRequest.php

Answer 1

Create an abstract SanitizedRequest class that extends the usual Request class.
YourRequest class should extend your SanitizedRequest abstract class.
Your SanitizedRequest class overrides Request::all() as like so...
namespace App\Http\Requests\Forms;
use App\Http\Requests\Request;
abstract class SanitizedRequest extends Request{
private $clean = false;
public function all(){
return $this->sanitize(parent::all());
}
protected function sanitize(Array $inputs){
if($this->clean){ return $inputs; }
foreach($inputs as $i => $item){
$inputs[$i] = trim($item);
}
$this->replace($inputs);
$this->clean = true;
return $inputs;
}
}
Then a normal CustomRequest, but extend SanitizedRequest instead of laravel's Request class
class ContactRequest extends SanitizedRequest{
public function authorize(){ return true; }
public function rules(){ return []; }
}

Answer 2

I just came across for the same problem.
I'd like to show you another way of doing it without extends but with traits. ( I will take the Example Classes from Tarek Adam ).
PHP Traits are like functions which will be injected into the used class. The one main difference is that a Trait doesn't need any dependency like a extends do. This means you can use a trait for more then just one class e.x. for Controllers, Requests and whatever you like.
Laravel provides some traits in the BaseController, we can do the same.
How to do it with a trait
Create a trait as file in \App\Traits\SanitizedRequest.php. You can create it anywhere it doesn't matter really. You have to provide the correct namespace for sure.
namespace App\Trait;
trait SanitizedRequest{
private $clean = false;
public function all(){
return $this->sanitize(parent::all());
}
protected function sanitize(Array $inputs){
if($this->clean){ return $inputs; }
foreach($inputs as $i => $item){
$inputs[$i] = trim($item);
}
$this->replace($inputs);
$this->clean = true;
return $inputs;
}
}
In your Request you can use the trait with use SanitizedRequest keyword.
namespace App\Http\Requests\Forms;
use App\Http\Requests\Request;
use App\Trait\SanitizedRequest; // Import the Trait
class ContactRequest extends Request {
use SanitizedRequest; // This line adds all the Trait functions to your current class
public function authorize(){ return true; }
public function rules(){ return []; }
}

Answer 3

In Laravel 9 (not sure about older versions) you can extend \Illuminate\Foundation\Http\Middleware\TransformsRequest middleware and do apply your logic there. So lets say you need to encode your input with htmlemntities() function, create a middleware
<?php
declare(strict_types=1);
namespace App\Http\Middleware;
class TransformsRequest extends \Illuminate\Foundation\Http\Middleware\TransformsRequest
{
/** #inheritDoc */
protected function transform($key, $value)
{
return is_string($value) ? htmlentities($value, ENT_QUOTES, "UTF-8") : $value;
}
}
Dont forget to apply this middleware globally in App\Http\Kernel.php
protected $middleware = [
// other middlewares...
\App\Http\Middleware\TransformsRequest::class,
];
This middleware will encode each value that comes from input for all requests.