Build a form that posts to store

Every form that changes data needs @csrf, which adds a hidden token proving the request came from your own site. Without it Laravel replies with a 419 error. (Learn why in CSRF & XSS.)

          <form method="POST" action="{{ route('posts.store') }}">
              @csrf

              <label for="title">Title</label>
              <input id="title" name="title" type="text">

              <label for="body">Body</label>
              <textarea id="body" name="body"></textarea>

              <button type="submit">Publish</button>
          </form>
        

Validate in the controller with $request->validate()

Pass an array of field ⇒ rules. If every rule passes, you get back an array containing only the validated fields, which is safe to hand to create().

          public function store(Request $request)
          {
              $validated = $request->validate([
                  'title'       => ['required', 'string', 'max:255'],
                  'body'        => ['required', 'string', 'min:20'],
                  'category_id' => ['nullable', 'exists:categories,id'],
              ]);

              $request->user()->posts()->create($validated);

              return redirect()->route('posts.index');
          }
        

Learn the rules you'll use daily

Rules can be written as an array (recommended) or a pipe string like 'required|max:255'.

Show errors and keep old input

After a failed submit, $errors is available in every view. @error('field') shows a block only when that field failed, with $message inside. old('field') refills what the user typed.

          <label for="title">Title</label>
          <input id="title" name="title" type="text"
                 value="{{ old('title') }}">
          @error('title')
              <p class="error">{{ $message }}</p>
          @enderror

          <label for="body">Body</label>
          <textarea id="body" name="body">{{ old('body') }}</textarea>
          @error('body')
              <p class="error">{{ $message }}</p>
          @enderror
        

Want a summary at the top of the form too?

          @if ($errors->any())
              <ul>
                  @foreach ($errors->all() as $error)
                      <li>{{ $error }}</li>
                  @endforeach
              </ul>
          @endif
        

Move rules into a Form Request class

When rules grow, or are shared between store and update, move them into a Form Request: a dedicated class that validates (and can authorize) before your controller method even starts.

          php artisan make:request StorePostRequest
        

          <?php

          namespace App\Http\Requests;

          use Illuminate\Foundation\Http\FormRequest;

          class StorePostRequest extends FormRequest
          {
              public function authorize(): bool
              {
                  return $this->user() !== null;   // only logged-in users
              }

              public function rules(): array
              {
                  return [
                      'title'       => ['required', 'string', 'max:255'],
                      'slug'        => ['required', 'alpha_dash', 'unique:posts,slug'],
                      'body'        => ['required', 'string', 'min:20'],
                      'category_id' => ['nullable', 'exists:categories,id'],
                      'tags'        => ['array'],
                      'tags.*'      => ['exists:tags,id'],
                  ];
              }

              public function messages(): array
              {
                  return ['slug.unique' => 'That URL is already taken. Try another slug.'];
              }
          }
        

Now just type-hint it. If validation fails, the method never runs.

          use App\Http\Requests\StorePostRequest;

          public function store(StorePostRequest $request)
          {
              $request->user()->posts()->create($request->validated());

              return redirect()->route('posts.index');
          }