Migrations and validation

Versioned schema changes you can roll back, and rules that keep unvalidated input away from the database.

Migrations

php artisan make:migration create_posts_table --create=posts
php artisan migrate
php artisan migrate:rollback --step=1
php artisan migrate:status

<?php
use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

return new class extends Migration
{
    public function up(): void
    {
        Schema::create('posts', function (Blueprint $table) {
            $table->id();
            $table->foreignId('user_id')->constrained()->cascadeOnDelete();
            $table->string('title', 200);
            $table->text('body');
            $table->timestamp('published_at')->nullable();
            $table->timestamps();
            $table->index(['published_at', 'user_id']);
        });
    }

    public function down(): void
    {
        Schema::dropIfExists('posts');
    }
};

• One migration per schema change, and never edit a migration that has already run in production — add a new one instead.
• foreignId(...)->constrained() creates the column, the index and the foreign key in a single call.
• migrate:rollback runs down() in reverse order, so keep it correct and a bad deploy stays reversible.
• migrate:fresh drops every table and reapplies everything; it is for local development only, never for a shared environment.
• Seeders belong in database/seeders and should be idempotent so they can run repeatedly.

Validation and form requests

php artisan make:request StorePostRequest

<?php
namespace App\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rule;

class StorePostRequest extends FormRequest
{
    public function authorize(): bool
    {
        return $this->user()->can('create', Post::class);
    }

    public function rules(): array
    {
        return [
            'title'   => ['required', 'string', 'max:200'],
            'body'    => ['required', 'string', 'min:20'],
            'slug'    => ['required', Rule::unique('posts', 'slug')->ignore($this->post)],
            'tags'    => ['array'],
            'tags.*'  => ['exists:tags,id'],
        ];
    }
}

public function store(StorePostRequest $request)
{
    // runs only if authorize() passed and the rules passed
    return Post::create($request->validated());
}

FAQ

Related

Controllers, Blade views and Eloquent models Installation and routing

Last refreshed 2026-09-18.