Weave Code
Forms Laravel Package
nette/forms
Nette Forms is a PHP library for building, rendering, and validating HTML forms with minimal code. It offers CSRF protection, file uploads, flexible controls, and a rich set of validation rules through a clean, secure, and extensible API.
📝 Generating, validating and processing secure forms in PHP. Handy API, fully customizable, server & client side validation and mature design.
Frequently asked questions about Forms
- Can I use nette/forms in a Laravel application?
- Yes, but nette/forms is a standalone Nette component, not a native Laravel package. A Laravel controller can drive it because Form::initialize() supports standalone instantiation since v3.1.2. Expect integration work around request binding, CSRF, rendering, and client-side assets rather than a drop-in experience. It is strongest when porting Nette forms or embedding a Nette/Latte admin surface beside a Laravel API.
- How do I install nette/forms with Composer?
- Install it with composer require nette/forms and pin a specific version rather than floating ^3.2. The package pulls transitive Nette dependencies such as nette/utils, nette/http, and nette/component-model, so review the lockfile diff. There is no Laravel service provider or facade to register because it is framework-neutral.
- Which PHP and Laravel versions does nette/forms support?
- nette/forms v3.2.x requires PHP 8.1, and v3.2.8 claims PHP 8.5 support; if your app is stuck on PHP 8.0 you are pinned to v3.1.x. Laravel version support is indirect because the package does not declare Laravel integration; compatibility depends on your PHP version and the adapters you write. Confirm the PHP constraint in Composer before planning a Laravel upgrade.
- How does nette/forms handle CSRF protection in Laravel?
- nette/forms has its own CsrfProtection backed by Nette session and isSameSite() request checks, which is separate from Laravel VerifyCsrfToken and XSRF-TOKEN handling. You must deliberately reconcile the two stacks or you can create a silent double-protection gap. allowCrossOrigin(), used in tests since v3.2.9, is a security-relevant escape hatch and should not be enabled casually in production.
- How do I render nette/forms in Blade instead of Latte?
- You can use DefaultFormRenderer for framework-neutral HTML and customize it with options such as setOptionAttribute, ControlGroup, and nextTo. Latte 3.1 rendering via {form}, {input}, {label}, and {inputError} is supported in v3.2.7 and v3.2.8, but that means running Latte alongside Blade. For a Blade-only app, budget for a Blade shim or accept the default renderer output.
- How do I load netteForms.js client-side validation with Vite in Laravel?
- netteForms.js expects elements with data-nette-rules attributes, and v3.2.3 narrowed how those attributes are processed. It will not participate in Laravel's default @vite HMR flow without configuration, so load it outside the normal pipeline or wrap it as a dedicated Vite entry point. Test the rendered attributes carefully after any server-side rule changes.
- How do I populate a Nette form from a Laravel request?
- Nette forms normally expect Nette\Http\IRequest and loadHttpData(), but Laravel's normalized request is not the same as PHP globals. You can either construct a Nette request from Request::createFromGlobals(), which only works for genuine globals, or call setValues() and accept the loss of loadHttpData() semantics. That loss includes newer SubmitButton and submitter handling added in v3.2.5 and v3.2.6, so verify submit behavior explicitly.
- How do I test nette/forms validation in a Laravel test suite?
- Unit-test form definitions directly by creating the form, calling setValues(), and asserting rules and errors without HTTP. For request-level tests, be careful with CSRF because allowCrossOrigin() since v3.2.9 bypasses same-site checks and should be limited to test code. Keep PHPUnit or Pest coverage around each rule export and rendered error message.
- Is nette/forms safe for production and actively maintained?
- It is a mature library with server and client-side validation, CSRF protection, and file upload support, but minor releases have carried behavioral breaks. Pin tightly and gate upgrades in CI because changes such as getValues(true) deprecation, scoped getValues(), addImageButton(), and getUntrustedValues() affect existing code. The license is reported as NOASSERTION, which is a hard gating item for commercial use until legal confirms the actual terms.
- What are alternatives to nette/forms for Laravel form validation?
- For a greenfield Laravel product, Illuminate\Validation, FormRequest, Blade components, @error, and VerifyCsrfToken are the natural alternatives and avoid a second validation and CSRF stack. Choose nette/forms when you are preserving existing Nette form definitions, embedding a Latte-based admin surface, or need its built-in server-plus-client rule export for regulated forms. Otherwise you will likely fight Laravel's rendering, error bags, and CSRF conventions.
Weaver
How can I help you explore Laravel packages today?