- How do I install laravel-request-sanitizer in a Laravel app?
- Install it with Composer using the package name arondeparon/laravel-request-sanitizer, then let Laravel package auto-discovery register it. You can optionally publish any configuration the package provides and add its trait or sanitizer pipeline to a base Form Request. The intended setup is to define sanitization rules per request and let validation run afterward.
- Does laravel-request-sanitizer support Laravel 12?
- Yes. Release 6.2.0 adds Laravel 12 support and appears additive, with no breaking changes called out in the release summary. You should still confirm the documented PHP version support and compatibility matrix for your exact Laravel and PHP versions before upgrading.
- How does Laravel Request Sanitizer work with Form Requests?
- It lets you attach reusable sanitizer classes or pipelines to Form Requests so incoming fields are trimmed, cast, lowercased, or otherwise normalized before validation rules execute. This removes repetitive prepareForValidation() boilerplate and keeps controllers and validation rules focused. A common pattern is to add the package integration to a project base request class and declare sanitizers per form request.
- Can I write custom sanitizers for my own input rules?
- Yes. The package is designed to be fully customizable, so you can write your own sanitizer classes in minutes and compose them individually or in pipelines. Custom sanitizers are useful for domain-specific normalization such as standardizing identifiers or converting blank values. Keep each sanitizer small and test its behavior against real request payloads.
- Does sanitizing request data replace validation or XSS protection?
- No. Sanitization is a request-boundary normalization step, not a security control. It does not replace validation, authorization, output escaping, or parameterized database queries. Treat it as a way to make input consistent before validation, not as an XSS or SQL injection defense.
- Does it handle nested arrays, JSON payloads, and file uploads?
- The package targets incoming request data, but nested arrays, JSON payloads, file uploads, and multipart requests are exactly the areas you should verify with explicit tests in your application. The technical assessment flags these as needing test coverage rather than assuming consistent behavior. If your API relies on them, add regression tests before rolling sanitizers out broadly.
- How should it interact with TrimStrings and ConvertEmptyStringsToNull?
- Laravel's global middleware already trims strings and converts empty strings to null, so avoid duplicating those behaviors blindly in sanitizer rules. Decide which layer owns each normalization and test the combined behavior, especially for nullable fields and API contracts. Scoping sanitization rules per Form Request helps prevent surprising global side effects.
- Can I use it with inline validation or route-level sanitization?
- The package is intended to work with Form Requests and inline validation, and sanitizers can be attached to routes or request classes. Even so, a base request class and a small convention document make adoption more repeatable. Avoid scattering one-off sanitizer calls across controllers.
- Is laravel-request-sanitizer safe for production use?
- It is MIT licensed and the 6.2.0 Laravel 12 support is a positive maintenance signal, but adoption is modest at roughly 112 stars. Before production use, review the repository's test suite, CI, issue responsiveness, and maintainer bus factor. Start with one low-risk Form Request and compare behavior against your existing normalization logic.
- How is it different from prepareForValidation() or middleware normalization?
- It replaces repetitive prepareForValidation() code with reusable sanitizer classes and pipelines that can be declared per request. Middleware-based normalization is broader and global, while this package keeps sanitization close to the request validation lifecycle. If you already have consistent middleware or DTO mapping, the package may add less value; if you have many Form Requests with duplicated normalization, it can improve consistency.