- What is sujan/laraform and what does it do?
- LaraForm is a Laravel form builder that turns YAML or JSON definitions into HTML forms with validation. It is intended for server-rendered CRUD screens, admin panels, internal tools, and reusable form components. It is not a good fit for API-first, SPA, or public customer-facing products without significant hardening.
- How do I install sujan/laraform in a Laravel application?
- Install it with Composer using composer require sujan/laraform, then check the README for any service provider, configuration, or view publishing steps. Pin the exact package version in composer.json and confirm Laravel package discovery before building forms. Run a sandbox spike first because the last release was in 2021.
- Which Laravel and PHP versions does LaraForm support?
- The Composer metadata and repository are the source of truth for supported Laravel and PHP versions. The assessment flags version drift risk because the last release date is 2021-09-28. Test compatibility against your target Laravel and PHP versions before adopting it.
- Is LaraForm safe for public-facing or customer forms?
- No, not without significant hardening and security review. The TPM assessment recommends it for internal admin panels, back-office tools, and prototypes rather than public customer forms or regulated flows. For public forms, use native Blade or Livewire with Laravel validation or a maintained form package.
- Can I let users edit LaraForm YAML or JSON definitions at runtime?
- Treat definitions as version-controlled config-as-code rather than user-editable content. If you expose YAML or JSON authoring, validate schemas in CI, restrict who can publish definitions, and test output escaping. User-editable definitions increase XSS, schema drift, and parse-error risk.
- How does LaraForm handle validation, CSRF, old input, and file uploads?
- LaraForm converts definitions into forms with validation hooks, but the assessment says to verify the exact behavior in a spike. Test Laravel validation integration, CSRF protection, old-input repopulation, and file upload support explicitly. Do not assume complete parity with native Laravel form requests.
- Does LaraForm escape form output to prevent XSS?
- Blade escaping and HTML injection behavior must be tested explicitly in your application. The assessment lists unescaped output as a key risk if definitions are user-editable or custom HTML is allowed. Render only trusted definitions and add regression tests for escaped output.
- Is sujan/laraform actively maintained and production ready?
- Community signals are weak: low stars, zero dependents, and a last release date of 2021-09-28. Treat it as vendored code, assign an internal owner, pin the version, and budget for forking or replacing it. Do not assume active vendor support or timely security patches.
- How should I integrate LaraForm to reduce lock-in risk?
- Wrap LaraForm behind an internal FormDefinition or Renderer interface so application code does not call the package directly. Pin the exact Composer version, keep YAML and JSON schemas versioned and validated in CI, and pilot one low-risk internal form first. If the pilot fails, replace the adapter with native Blade or Livewire.
- What are alternatives to LaraForm for Laravel forms?
- Native Blade components, Livewire forms, and Laravel validation are lower-risk alternatives for many CRUD and admin screens. Maintained form-builder packages may also fit if they support your Laravel version and security requirements. Choose based on maintenance status, escaping, validation integration, and long-term ownership.