Laravel: validating backend submitted data

Question

I am building an application for a smaller group of administrators which will be locked down by password. Take it as a small "intranet" app. As my post data is getting larger (many of input fields, long forms), I am wondering about security.

My app is written with AngularJS, so I have made a full frontend validation.

NOTE: I am not using routes with AngularJS, Laravel is taking care of that. All of the data is posted by Ajax calls, Laravel is inserting data in database. Both frameworks are running on same domain.

So, here I my concerns:

Should I still validate data at the backend?

Here is my thinking.

Laravel uses CSRF protection, so no data can be submitted from other "outside" form.
If user (administrator) submits string but not integer as needed (by defined on database structure), insert will not happen.
Laravel escapes input data, so I presume no SQL injection can be performed? I am using Eloquent ORM through all of my code.
Is there something more? In general, what could be validated? Just types of inputs?

Extra question: What should I be doing differently if my app wasn't behind password?

jmoo · Accepted Answer · 2015-06-29 18:31:04Z

1

In general, yes.

If a mistake is made while working on the front-end, you can end up sending data in a format that your application might not be able to handle.

Also, data from the client cannot always be relied on. Different browsers might behave in different ways and can send you data in unpredictable ways.

You should validate for minimum/maximum length, format (proper email address, file names, etc), etc. depending on the type of value on the backend as well.

answered Jun 29, 2015 at 18:31

jmoo

714 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Saeed Zhiany · Accepted Answer · 2018-11-13 05:10:44Z

0

Include csrf token in request header while send data through ajax.

After receiving request data in controller just include laravel validation like this:

$validationData = $request->validate([
    'title' =>'required|unique:posts|max:255,
]);

edited Nov 13, 2018 at 5:10

Saeed Zhiany

2,1419 gold badges34 silver badges44 bronze badges

answered Nov 13, 2018 at 4:38

rahulaggarwal11

264 bronze badges

Collectives™ on Stack Overflow

Laravel: validating backend submitted data

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related