Strict Request Input Casting in Laravel 13.40 | Mohamed Said [Skip to content](#main) [ ![](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MH.png) Mohamed SaidLaravel Backend Engineer ](https://www.msaied.com) - [Home](https://www.msaied.com) - [Projects](https://www.msaied.com/projects) - [Articles](https://www.msaied.com/articles) - [Certificates](https://www.msaied.com/certificates) - [About](https://www.msaied.com#about) [ Contact](https://www.msaied.com#contact) Menu Menu ---- Close - [HomeStart here](https://www.msaied.com) - [ProjectsCase studies](https://www.msaied.com/projects) - [ArticlesEngineering notes](https://www.msaied.com/articles) - [CertificatesCredentials](https://www.msaied.com/certificates) - [AboutHow I work](https://www.msaied.com#about) - [ContactGet in touch](https://www.msaied.com#contact) [Start a conversation](https://www.msaied.com#contact) [WhatsApp](https://wa.me/201094619204) [Email](mailto:hello@msaied.com) 1. [Home](https://www.msaied.com) 2. / 3. [Articles](https://www.msaied.com/articles) 4. / 5. [Laravel](https://www.msaied.com/articles?category=laravel) 6. / 7. Strict Request Input Casting in Laravel 13.40 [Laravel](https://www.msaied.com/articles?category=laravel) [Tips & Tricks](https://www.msaied.com/articles?category=tips-tricks) Strict Request Input Casting in Laravel 13.40 ============================================== Laravel 13.40 adds a `strict` argument to request casting helpers like `integer()`, `float()`, `boolean()`, and `string()`. Invalid input now returns your default instead of silently producing wrong values or throwing errors. ![](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp) [Mohamed Said](https://www.msaied.com#person) Published 5 Nov 2026 · Updated 9 Nov 2026 · 4 min read ShareCopy linkCopied ![Strict Request Input Casting in Laravel 13.40](https://cdn.msaied.com/820/d87884969c96b6d38c264c4213db8d12.png) On this page +1. [The Problem With Default Casting](#the-problem-with-default-casting) 2. [Adding strict: true](#adding-codestrict-truecode) 3. [integer()](#codeintegercode) 4. [float()](#codefloatcode) 5. [boolean()](#codebooleancode) 6. [string()](#codestringcode) 7. [Lazy Defaults and Nullable Returns](#lazy-defaults-and-nullable-returns) 8. [Where the Flag Is Available](#where-the-flag-is-available) 9. [When to Use Validation Instead](#when-to-use-validation-instead) 10. [Key Takeaways](#key-takeaways) Laravel's request object has long offered convenient casting helpers — `$request->integer('page')`, `$request->boolean('active')`, and so on. They work well when input arrives in the expected shape. When it doesn't, the results can be surprising: a plain PHP `(int)` cast turns `'abc123'` into `0`, and casting an array to a string raises an `Array to string conversion` error. Laravel 13.40 addresses both problems by adding a `strict` named argument to these helpers. The Problem With Default Casting -------------------------------- Consider a paginated listing that reads a per-page count from the query string: ```php $perPage = $request->integer('per_page', 25); ``` The default `25` only applies when `per_page` is absent. A request to `/posts?per_page=abc123` produces `0` — not `25` — because `(int) 'abc123'` is `0` in PHP. Likewise, `$request->string('name')` throws an `ErrorException` when the request contains `?name[]=chris`, because casting an array to a string is a PHP error. These are silent, edge-case bugs that are easy to miss in code review. Adding `strict: true` --------------------- Pass `strict: true` as a named argument and the helper validates the value before casting it. If the value is not valid for the target type, the default is returned instead: ```php $perPage = $request->integer('per_page', 25, strict: true); $archived = $request->boolean('archived', false, strict: true); $price = $request->float('max_price', 100.0, strict: true); $name = $request->string('name', 'guest', strict: true); ``` ### `integer()` The value must be a valid integer. Decimals, leading zeros, and numbers that overflow PHP's `int` all fall back to the default: ```php // ?per_page=50 => 50 // ?per_page=12.5 => 25 (default) // ?per_page=007 => 25 (default) // ?per_page=9999999999999999999 => 25 (default) ``` ### `float()` Whole numbers and exponent notation are accepted. Thousands separators and non-numeric strings are not: ```php // ?max_price=49.99 => 49.99 // ?max_price=1e3 => 1000.0 // ?max_price=1,000 => 100.0 (default) // ?max_price=abc => 100.0 (default) ``` ### `boolean()` Without the flag, anything that isn't a truthy value is silently `false`. With `strict: true`, only recognised truthy (`1`, `true`, `on`, `yes`) and falsy (`0`, `false`, `off`, `no`) values are accepted. Everything else returns the default: ```php // ?notify=yes => true // ?notify=off => false // ?notify=maybe => true (default — not silently false) ``` ### `string()` Strings and numbers pass. Arrays, booleans, and `null` return the default, still wrapped in a `Stringable`: ```php $sort = $request->string('sort', 'created_at', strict: true)->lower(); // ?sort=Title => "title" // ?sort[]=title => "created_at" (default) // ?sort= => "created_at" (default — empty becomes null via middleware) ``` Lazy Defaults and Nullable Returns ---------------------------------- The default can be a closure; it only runs when the default is actually needed: ```php $teamId = $request->integer( 'team_id', fn () => $request->user()->current_team_id, strict: true ); ``` In strict mode, the default is returned as-is and is not cast. Passing `null` lets you distinguish "no usable value" from a legitimate zero: ```php $limit = $request->integer('limit', null, strict: true); if ($limit === null) { // No usable limit provided } ``` Without the flag, the same call returns `0`, making that distinction impossible. Where the Flag Is Available --------------------------- The helpers come from the `InteractsWithData` trait, so `strict` works on every class that uses it, including `Illuminate\Support\Fluent`, `ValidatedInput` (from `$request->safe()`), `UriQueryString` (from `Uri::query()`), `ComponentAttributeBag`, and `CommandInput` in Artisan commands. When to Use Validation Instead ------------------------------ The strict flag returns a default silently — no error is surfaced to the user. That is the right behaviour for optional parameters like page sizes, sort directions, and display toggles. When bad input represents a user mistake that should be corrected — an order quantity, a required ID — use Laravel's validation layer to return a proper error response. Key Takeaways ------------- - `strict: true` prevents silent bad casts by returning the default for invalid input. - Each helper (`integer`, `float`, `boolean`, `string`) defines its own validity rules. - The default can be a closure and is never cast in strict mode. - Passing `null` as the default lets you detect missing or invalid input explicitly. - The flag is available on any class using the `InteractsWithData` trait, not just `Request`. - Use validation when invalid input should produce a user-facing error, not a silent fallback. Contributed by Chris Morrell ([@inxilpro](https://github.com/inxilpro)) in [PR #62254](https://github.com/laravel/framework/pull/62254). --- *Source: [Strict Request Input Casting in Laravel — Laravel News](https://laravel-news.com/laravel-strict-request-input)* - [Laravel](https://www.msaied.com/articles?search=Laravel) - [PHP](https://www.msaied.com/articles?search=PHP) - [Request](https://www.msaied.com/articles?search=Request) - [Laravel 13](https://www.msaied.com/articles?search=Laravel%2013) - [Input Casting](https://www.msaied.com/articles?search=Input%20Casting) Frequently asked questions --------------------------- What does `strict: true` do in Laravel's request casting helpers?When you pass `strict: true` to helpers like `integer()`, `float()`, `boolean()`, or `string()`, the helper validates the input value before casting it. If the value is not valid for the target type — for example, a string like `'abc'` passed to `integer()` — the helper returns your specified default instead of producing an incorrect cast result like `0`. When should I use `strict: true` instead of Laravel validation?Use `strict: true` for optional parameters where a sensible fallback is acceptable, such as page sizes, sort directions, or display toggles. Use Laravel's validation layer when invalid input represents a user error that should be reported back — for example, a required order quantity or a mandatory ID field. Is the `strict` argument available only on `Illuminate\\Http\\Request`?No. The `strict` argument comes from the `InteractsWithData` trait, so it is available on `Illuminate\\Support\\Fluent`, `ValidatedInput` (returned by `$request->safe()`), `UriQueryString` (returned by `Uri::query()`), `ComponentAttributeBag` in Blade components, and `CommandInput` in Artisan commands. ![Mohamed Said](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp)About the author ---------------- [Mohamed Said](https://www.msaied.com#person)Senior Backend Engineer specializing in Laravel, scalable SaaS platforms, APIs, and cloud infrastructure. I build secure, high-performance web applications that help businesses grow. [About](https://www.msaied.com#about) [GitHub ↗](https://github.com/EG-Mohamed) [LinkedIn ↗](https://www.linkedin.com/in/msaiedm/) [WhatsApp ↗](https://wa.me/201094619204) [Email Address ↗](mailto:hello@msaied.com) [My CV ↗](https://drive.google.com/file/u/0/d/1MF20IPRJyzfy32mhEutjL5EpSls0w2Q8/view) [Previous articlePost Mortem: How Laravel Patched PHP and Node.js Vulnerabilities Across Its Entire Fleet](https://www.msaied.com/articles/post-mortem-how-laravel-patched-php-and-nodejs-vulnerabilities-across-its-entire-fleet) [Next articleLaravel Herd 2: Coding Agents, Workspaces, and Cloud Deploys](https://www.msaied.com/articles/laravel-herd-2-coding-agents-workspaces-and-cloud-deploys) On this page ------------- 1. [The Problem With Default Casting](#the-problem-with-default-casting) 2. [Adding strict: true](#adding-codestrict-truecode) 3. [integer()](#codeintegercode) 4. [float()](#codefloatcode) 5. [boolean()](#codebooleancode) 6. [string()](#codestringcode) 7. [Lazy Defaults and Nullable Returns](#lazy-defaults-and-nullable-returns) 8. [Where the Flag Is Available](#where-the-flag-is-available) 9. [When to Use Validation Instead](#when-to-use-validation-instead) 10. [Key Takeaways](#key-takeaways) ### Have a technical challenge? Tell me what you’re building. I reply within two working days. [Start a conversation](https://www.msaied.com#contact) Related articles ----------------- [ ![](https://cdn.msaied.com/818/b17de0c62dc689581d4135b9cb797240.png) Laravel · 4 min read### Laravel Herd 2: Coding Agents, Workspaces, and Cloud Deploys 5 Nov 2026 ](https://www.msaied.com/articles/laravel-herd-2-coding-agents-workspaces-and-cloud-deploys) [ ![](https://cdn.msaied.com/817/1f6e0273ce6e6ecf37ad8c7616c60135.png) Laravel · 4 min read### Post Mortem: How Laravel Patched PHP and Node.js Vulnerabilities Across Its Entire Fleet 4 Nov 2026 ](https://www.msaied.com/articles/post-mortem-how-laravel-patched-php-and-nodejs-vulnerabilities-across-its-entire-fleet) [ ![](https://cdn.msaied.com/819/3c1bb5eb13679baf8274303d250566c1.png) Laravel · 3 min read### Prevent Duplicate File Uploads With Laravel Storage Dedupler 3 Nov 2026 ](https://www.msaied.com/articles/prevent-duplicate-file-uploads-with-laravel-storage-dedupler) Have a technical challenge? ---------------------------- Tell me what you’re building. I reply within two working days. [Discuss your project ↗](https://www.msaied.com#contact) © 2026 Mohamed Said · Built with Laravel, meant to last.Senior Backend Engineer specializing in Laravel, scalable SaaS platforms, APIs, and cloud infrastructure. I build secure, high-performance web applications that help businesses grow. - [Home](https://www.msaied.com) - [Articles](https://www.msaied.com/articles) - [Certificates](https://www.msaied.com/certificates) - [GitHub](https://github.com/EG-Mohamed) - [LinkedIn](https://www.linkedin.com/in/msaiedm/) - [WhatsApp](https://wa.me/201094619204) - [Email Address](mailto:hello@msaied.com) - [My CV](https://drive.google.com/file/u/0/d/1MF20IPRJyzfy32mhEutjL5EpSls0w2Q8/view) - [Sitemap](https://www.msaied.com/sitemap.xml)