Flick
Guide Validation Services API Pro Examples GitHub
Docs / Reference

Form Validation

Flick provides several ways in which you can validate your incoming form data, along with many predefined rules and helpers you can use for verification and formatting.

Validating Input

Validating form input is surprisingly easy! Using the request() method, add an array to the second parameter and insert your rules.

Let's make sure our form's zip field is an integer, is required, and has at least five characters.

$zipCode = $form->request('zip', ['int', 'required', 'min:5']);

Custom Messages

Each validation rule has a predefined message that will be presented upon validation error. However, it's quite easy to add your own by passing an array to the third parameter of the request() method. Enter the rule as the key and your custom message as the value.

$zipCode = $form->request('zip',
    [
        'int',
        'required',
        'min:5'
    ],
    [
        'int' => 'The zip code must be a number',
        'required' => 'Your zip code is required',
        'min' => 'Your zip code must be at least 5 numbers'
    ]
);

Tip

You can find more examples of using validation rules and messages on the Requests page.

Available Validation Rules

Following is a list of Flick's validation rules and helpers.

after

Validates that the input date is chronologically after a specified reference date.

  • after:date

Parameters

  • date: The reference date. Can be a date string or relative terms like 'today', 'tomorrow'.
$form->request('start_date', 'after:2023-01-01');
$form->request('event_date', 'after:today');

Notes

  • Utilizes the date format defined in Flick's configuration (dateFormat).
  • Compatible with date strings that PHP's strtotime() function can parse.
  • If the input is empty, validation is skipped.

afterOrEqual

Validates that the input date is either after or equal to a specified reference date.

  • afterOrEqual:date

Parameters

  • date: The reference date. Can be a date string or relative terms like 'today', 'tomorrow'.
$form->request('start_date', 'afterOrEqual:2023-01-01');
$form->request('event_date', 'afterOrEqual:today');

alpha

Validates that the input contains only alphabetic characters.

$form->request('name', 'alpha');

Notes

  • Allows spaces in addition to alphabetic characters.
  • If the input is empty, validation is skipped.

alphaDash

Validates that the input contains only alphanumeric characters, dashes, and underscores.

$form->request('username', 'alphaDash');

alphaNumeric

Validates that the input contains only letters and numbers.

$form->request('code', 'alphaNumeric');

Notes

  • No spaces or symbols are allowed (unlike alpha, which permits spaces).
  • If the input is empty, validation is skipped.

startsWith

Validates that the input starts with one of the given values.

$form->request('website', 'startsWith:http://,https://');

Notes

  • Pass one or more comma-separated prefixes; the value passes if it starts with any of them.
  • Matching is case-sensitive.
  • Arguments may contain colons, so URL schemes work as written.

endsWith

Validates that the input ends with one of the given values.

$form->request('email', 'endsWith:.com,.net,.org');

Notes

  • Pass one or more comma-separated suffixes; the value passes if it ends with any of them.
  • Matching is case-sensitive.

accepted

Validates that the input is an accepted value, typically used for terms of service checkboxes.

$form->request('terms', 'accepted');

Notes

  • Accepts the following values: "yes", "on", "1", "true" (case-insensitive).
  • Useful for checkbox fields that require user acceptance.
  • Unlike most rules, this validates against empty inputs.

before

Validates that the input date is chronologically before a specified reference date.

  • before:date
$form->request('birth_date', 'before:2000-01-01');
$form->request('submission_date', 'before:today');

beforeOrEqual

Validates that the input date is either before or equal to a specified reference date.

  • beforeOrEqual:date
$form->request('birth_date', 'beforeOrEqual:2000-01-01');
$form->request('submission_date', 'beforeOrEqual:today');

between

Validates that the input value is between two specified numbers.

  • between:min,max
$form->request('age', 'between:18,65');

Notes

  • Works with numeric inputs only.
  • Both minimum and maximum values are inclusive.

boolean

Validates that the input is a boolean-like value.

$form->request('newsletter', 'boolean');

Notes

  • Accepts the following values: "true", "false", "1", "0" (case-insensitive).

confirmed

Validates that the input matches a confirmation field with the same name plus _confirmation suffix.

$form->request('password', 'confirmed');
// This will check that $_POST['password'] === $_POST['password_confirmation']

creditCard

Validates that the input is a valid credit card number using the Luhn algorithm.

$form->request('card_number', 'creditCard');

date

Validates that the input is a valid date in Flick's configured date format (dateFormat, Y-m-d by default).

$form->request('start_date', 'date');

Notes

  • The input must match the dateFormat config value exactly — with the default format, 2023-01-01 passes and 01/01/2023 fails.
  • If the input is empty, validation is skipped.

email

Validates that the input is a properly formatted email address.

$form->request('user_email', 'email');

equals

Validates that the input is equal to a specified value.

  • equals:value
$form->request('terms', 'equals:accepted');

exact

Validates that the input has an exact length.

  • exact:length
$form->request('verification_code', 'exact:6');

greaterThan

Validates that the input is greater than a specified value.

  • greaterThan:value
$form->request('score', 'greaterThan:50');

greaterThanOrEqual

Validates that the input is greater than or equal to a specified value.

  • greaterThanOrEqual:value
$form->request('age', 'greaterThanOrEqual:18');

in

Validates that the input is one of the specified values.

  • in:value1,value2,value3
$form->request('color', 'in:red,green,blue');
$form->request('size', 'in:small,medium,large');

integer

Validates that the input is an integer.

  • integer or int
$form->request('quantity', 'integer');

digits

Validates that the input is exactly N digits.

$form->request('zip', 'digits:5');

Notes

  • Only digits 0-9 are allowed; leading zeros are kept (e.g. a ZIP code or one-time code).
  • If the input is empty, validation is skipped.

digitsBetween

Validates that the input is all digits with a length between a minimum and maximum.

$form->request('pin', 'digitsBetween:4,6');

Notes

  • Only digits 0-9 are allowed; the length must be between the two values (inclusive).
  • If the input is empty, validation is skipped.

ip

Validates that the input is a valid IP address.

$form->request('ip_address', 'ip');

ipv4

Validates that the input is a valid IPv4 address.

$form->request('server_ip', 'ipv4');

ipv6

Validates that the input is a valid IPv6 address.

$form->request('server_ip', 'ipv6');

json

Validates that the input is a valid JSON string.

$form->request('config', 'json');

lessThan

Validates that the input is less than a specified value.

  • lessThan:value
$form->request('temperature', 'lessThan:100');

lessThanOrEqual

Validates that the input is less than or equal to a specified value.

  • lessThanOrEqual:value
$form->request('discount', 'lessThanOrEqual:100');

matches

Validates that the input matches the value of another field.

  • matches:field
$form->request('password_confirm', 'matches:password');

max

Validates that the input does not exceed a maximum length.

  • max:length
$form->request('username', 'max:20');

min

Validates that the input meets or exceeds a minimum length.

  • min:length
$form->request('password', 'min:8');

notIn

Validates that the input is NOT one of the specified values.

  • notIn:value1,value2,value3
$form->request('username', 'notIn:admin,root,superuser');

notMatches

Validates that the input does not match the value of another field.

  • notMatches:field
$form->request('new_password', 'notMatches:current_password');

notRegex

Validates that the input does not match a specified regular expression pattern.

  • notRegex:pattern
$form->request('username', 'notRegex:/^admin/i');

numeric

Validates that the input is a numeric value.

$form->request('price', 'numeric');

phone

Validates that the input is a valid phone number.

$form->request('phone_number', 'phone');

regex

Validates that the input matches a specified regular expression pattern.

  • regex:pattern
$form->request('postal_code', 'regex:/^[A-Z]\d[A-Z]\s\d[A-Z]\d$/');

required

Validates that the input field is not empty.

$form->request('username', 'required');

requiredWith

Validates that the input field is not empty if another specified field has a value.

  • requiredWith:field
$form->request('card_cvv', 'requiredWith:card_number');

strongPassword

Validates that the input meets strong password requirements.

  • strongPassword or strongPassword:length
$form->request('password', 'strongPassword');
$form->request('password', 'strongPassword:12');

Notes

  • Requires at least one uppercase letter.
  • Requires at least one lowercase letter.
  • Requires at least one digit.
  • Requires at least one special character.
  • Minimum length defaults to 8 characters, but can be customized.

url

Validates that the input is a valid URL.

$form->request('website', 'url');

uuid

Validates that the input is a valid UUID (version 4).

$form->request('transaction_id', 'uuid');

Input Trimming

Flick trims surrounding whitespace off input values before validation rules run — the same thing Laravel does by default. A user who types ' jane@example.com ' (mobile keyboards love adding that trailing space) passes the email rule and gets back 'jane@example.com'.

Three things to know:

  • Password fields are never trimmed: whitespace can be a deliberate part of a password or password_confirmation value.
  • The returned value is the trimmed value, and cross-field rules (matches, notMatches, confirmed, requiredWith) compare trimmed values on both sides.
  • Client-side validation (the Pro validation service) applies the same policy, so the browser and the server agree.

If you need the raw values, turn it off per form:

$form = new Flick([
    'trim' => false,
]);

String Modifiers

Modifiers change the returned value only. Validation rules run against the posted value after input trimming (see above) — nothing else is cleaned up first, so ['email', 'sanitizeEmail'] validates what the user typed minus the surrounding whitespace, then returns the sanitized version. A value that only becomes valid after sanitizing will still fail validation.

bcrypt

Hashes the input string using the bcrypt algorithm.

$form->request('password', ['required', 'bcrypt']);

hash

An alias for the bcrypt modifier.

$form->request('password', ['required', 'hash']);

sanitizeChars

Sanitizes the input string by converting special characters to HTML entities.

$form->request('user_input', ['required', 'sanitizeChars']);

sanitizeEmail

Sanitizes the input string by removing invalid email characters.

$form->request('email', ['required', 'email', 'sanitizeEmail']);

sanitizeInt

Sanitizes the input by removing all characters except digits, plus and minus sign.

$form->request('quantity', ['required', 'integer', 'sanitizeInt']);

sanitizeUrl

Removes all characters except valid URL characters.

$form->request('website', ['required', 'url', 'sanitizeUrl']);

slug

Converts the input string to a URL-friendly slug. Words are joined with underscores, not hyphens.

$form->request('title', ['required', 'slug']);
// 'Hello World! Some Title' becomes 'Hello_World_Some_Title'

stripAlpha

Keeps only the digits 0-9. Letters, spaces, and punctuation are all removed.

$form->request('code', ['required', 'stripAlpha']);
// 'a1b2c3' becomes '123'

stripNumeric

Keeps only the letters a-z and A-Z. Digits, spaces, and punctuation are all removed.

$form->request('name', ['required', 'stripNumeric']);
// 'Gern9 Blanston2' becomes 'GernBlanston'

stripTags

Strips HTML and PHP tags from the input string.

$form->request('description', ['required', 'stripTags']);