Laravel is an expressive and progressive web application framework for PHP. This cheat sheet provides a reference for common commands and features for Laravel 8.

#Getting Started


  • PHP version >= 7.3
  • BCMath PHP Extension
  • Ctype PHP Extension
  • Fileinfo PHP Extension
  • JSON PHP Extension
  • Mbstring PHP Extension
  • OpenSSL PHP Extension
  • PDO PHP Extension
  • Tokenizer PHP Extension
  • XML PHP Extension

Ensure your web server directs all requests to your application's public/index.php file, See: Deployment


Access application via http://localhost


  • #Install Docker Desktop

  • #In terminal:

    $ curl -s https://laravel.build/example-app | bash
    $ cd example-app
    $ ./vendor/bin/sail up

Access application via http://localhost


$ curl -s https://laravel.build/example-app | bash
$ cd example-app
$ ./vendor/bin/sail up

Installation via Composer

$ composer create-project laravel/laravel example-app
$ cd example-app
$ php artisan serve

Access application via http://localhost



Retrieve values from .env file


// with default value
env('APP_DEBUG', false);

Determine current environment

use Illuminate\Support\Facades\App;

$environment = App::environment();

Accessing configuration values using "dot" syntax

// config/app.php --> ['timezone' => '']
$value = config('app.timezone');

// Retrieve a default value if the configuration value does not exist...
$value = config('app.timezone', 'Asia/Seoul');

Set configuration values at runtime:

config(['app.timezone' => 'America/Chicago']);

#Debug Mode

Turn on (local dev):

// .env file
// ...

Turn off (production):

// .env file
// ...

#Maintenance Mode

Temporarily disable application (503 status code)

php artisan down

#Disable maintenance mode

php artisan up

#Bypass Maintenance Mode

php artisan down --secret="1630542a-246b-4b66-afa1-dd72a4c43515"

Visit your application URL https://example.com/1630542a-246b-4b66-afa1-dd72a4c43515 to set a cookie and bypass the maintenance screen


#Router HTTP Methods

Route::get($uri, $callback);
Route::post($uri, $callback);
Route::put($uri, $callback);
Route::patch($uri, $callback);
Route::delete($uri, $callback);
Route::options($uri, $callback);

Multiple HTTP methods

Route::match(['get', 'post'], '/', function () {

Route::any('/', function () {

#Basic Definition

use Illuminate\Support\Facades\Route;

// closure
Route::get('/greeting', function () {
    return 'Hello World';

// controller action
    [UserProfileController::class, 'show']

#Dependency Injection

use Illuminate\Http\Request;

Route::get('/users', function (Request $request) {
    // ...

Type hint concrete dependencies for auto-injection

#View Routes

// Argument 1: URI, Argument 2: view name
Route::view('/welcome', 'welcome');

// with data
Route::view('/welcome', 'welcome', ['name' => 'Taylor']);

Route only needs to return a view.

#Route Model Binding

#Implicit binding

With closure

use App\Models\User;

Route::get('/users/{user}', function (User $user) {
    return $user->email;

// /user/1 --> User::where('id', '=', 1);

With controller action

use App\Http\Controllers\UserController;
use App\Models\User;

// Route definition...
Route::get('/users/{user}', [UserController::class, 'show']);

// Controller method definition...
public function show(User $user)
    return view('user.profile', ['user' => $user]);

With custom resolution column

use App\Models\Post;

Route::get('/posts/{post:slug}', function (Post $post) {
    return $post;

// /posts/my-post --> Post::where('slug', '=', 'my-post');

Always use a different column to resolve

// in App\Models\Post
public function getRouteKeyName()
    return 'slug';

Multiple models - second is child of first

use App\Models\Post;
use App\Models\User;

Route::get('/users/{user}/posts/{post:slug}', function (User $user, Post $post) {
    return $post;

Convenient way to automatically inject the model instances directly into your routes

#Route Parameters

Capture segments of the URI within your route

#Required parameters

Route::get('/user/{id}', function ($id) {
    return 'User '.$id;

With dependency injection

use Illuminate\Http\Request;

Route::get('/user/{id}', function (Request $request, $id) {
    return 'User '.$id;

#Optional Parameters

Route::get('/user/{name?}', function ($name = null) {
    return $name;

Route::get('/user/{name?}', function ($name = 'John') {
    return $name;

#Redirect Routes

HTTP 302 status

Route::redirect('/here', '/there');

Set the status code

Route::redirect('/here', '/there', 301);

Permanent 301 redirect

Route::permanentRedirect('/here', '/there');

#Regular Expression Constraints

Route::get('/user/{name}', function ($name) {
})->where('name', '[A-Za-z]+');

Route::get('/user/{id}', function ($id) {
})->where('id', '[0-9]+');

Route::get('/user/{id}/{name}', function ($id, $name) {
})->where(['id' => '[0-9]+', 'name' => '[a-z]+']);

See also: Regex Cheatsheet

#Named Routes

Route names should always be unique

Route::get('/user/profile', function () {

See: Helpers

#Fallback Routes

Route::fallback(function () {

Executed when no other routes match

#Route Groups


Route::middleware(['first', 'second'])->group(function () {
    Route::get('/', function () {
        // Uses first & second middleware...

    Route::get('/user/profile', function () {
        // Uses first & second middleware...

#URI Prefixes

Route::prefix('admin')->group(function () {
    Route::get('/users', function () {
        // Matches The "/admin/users" URL

#Name Prefix

Route::name('admin.')->group(function () {
    Route::get('/users', function () {
        // Route assigned name "admin.users"...

Share attributes across routes

#Accessing current route

use Illuminate\Support\Facades\Route;

// Illuminate\Routing\Route
$route = Route::current();

// string
$name = Route::currentRouteName();

// string
$action = Route::currentRouteAction();



#Named route

$url = route('profile');

With parameters

// Route::get('/user/{id}/profile', /*...*/ )->name('profile);

$url = route('profile', ['id' => 1]);

// /user/1/profile/

With query string

// Route::get('/user/{id}/profile', /*...*/ )->name('profile);

$url = route('profile', ['id' => 1, 'photos'=>'yes']);

// /user/1/profile?photos=yes


// Generating Redirects...
return redirect()->route('profile');

#Eloquent Models

echo route('post.show', ['post' => $post]);

The route helper will automatically extract the model's route key. See Routing

#URL Generation

Generate arbitrary URLs for your application that will automatically use the scheme (HTTP or HTTPS) and host from the current request

$post = App\Models\Post::find(1);

echo url("/posts/{$post->id}");

// http://example.com/posts/1

#Current URL

// Get the current URL without the query string...
echo url()->current();

// Get the current URL including the query string...
echo url()->full();

// Get the full URL for the previous request...
echo url()->previous();

#Named Route URL

$url = route('profile');

See Named Route

#Error Handling

public function isValid($value)
    try {
        // Validate the value...
    } catch (Throwable $e) {

        return false;

Report an exception but continue handling the current request

#HTTP Exceptions

// page not found

Generate an HTTP exception response using status code



namespace App\Http\Controllers;

use App\Http\Controllers\Controller;
use App\Models\User;

class UserController extends Controller
    public function show($id)
        return view('user.profile', [
            'user' => User::findOrFail($id)

Define a route for this controller method:

use App\Http\Controllers\UserController;

Route::get('/user/{id}', [UserController::class, 'show']);


#CSRF Protection

Laravel automatically generates a CSRF "token" for each active user session.
This token is used to verify that the authenticated user is the person actually making the requests.

Get current session's token:

Route::get('/token', function (Request $request) {
    $token = $request->session()->token();

    $token = csrf_token();

    // ...

POST, PUT, PATCH, or DELETE forms should include a hidden CSRF _token field in the form to validate the request.

<form method="POST" action="/profile">

    <!-- Equivalent to... -->
    <input type="hidden" name="_token" value="{{ csrf_token() }}" />

See Forms

#Accessing Request

Get an instance of the current request by type-hinting the controller action or route closure

// controller action
class UserController extends Controller
    public function store(Request $request)
        $name = $request->input('name');

// closure
Route::get('/', function (Request $request) {

See Routing


The request's path information

$uri = $request->path();

// https://example.com/foo/bar --> foo/bar

#Match path to pattern

Verify that the incoming request path matches a given pattern

// * is wildcard
if ($request->is('admin/*')) {

Determine if the incoming request matches a named route

if ($request->routeIs('admin.*')) {


Full URL for the incoming request

// URL without the query string
$url = $request->url();

// URL including query string
$urlWithQueryString = $request->fullUrl();

// append data to query string
$request->fullUrlWithQuery(['type' => 'phone']);

#Request Method

$method = $request->method();

// verify that the HTTP verb matches a given string
if ($request->isMethod('post')) {

#Client IP

$ipAddress = $request->ip();


$value = $request->header('X-Header-Name');

$value = $request->header('X-Header-Name', 'default value');

// determine if the request contains a given header
if ($request->hasHeader('X-Header-Name')) {

// retrieve a bearer token from the Authorization header
$token = $request->bearerToken();

#Content Type

Return an array containing all the content types accepted by the request

$contentTypes = $request->getAcceptableContentTypes();

Boolean check for content types are accepted by the request

if ($request->accepts(['text/html', 'application/json'])) {
    // ...


Retrieve all the incoming request's input data as an array

$input = $request->all();

Retrieve all the incoming request's input data as a collection

$input = $request->collect();

// retrieve subset as collection
$request->collect('users')->each(function ($user) {
    // ...

See Helpers

Retrieve user input (also gets values from query string)

$name = $request->input('name');

// with default value if none present
$name = $request->input('name', 'Sally');

Access array inputs

$name = $request->input('products.0.name');

$names = $request->input('products.*.name');

Retrieve all the input values as an associative array:

$input = $request->input();

Only retrieve values from the query string:

$name = $request->query('name');

// with default value
$name = $request->query('name', 'Helen');

Retrieve all the query string values as an associative array:

$query = $request->query();

#Boolean Input Values

Helpful for checkbox inputs or other booleans. Return true for 1, "1", true, "true", "on", and "yes".
All other values will return false

$archived = $request->boolean('archived');

#Dynamic Properties

Access inputs via properties.
If not found as an input, the route parameters will be checked.

$name = $request->name;

#Retrieve Partial Input

$input = $request->only(['username', 'password']);

$input = $request->only('username', 'password');

$input = $request->except(['credit_card']);

$input = $request->except('credit_card');

#Check Existence

Determine if value(s) present

if ($request->has('name')) {

// check if ALL values are present
if ($request->has(['name', 'email'])) {

// if any values are present
if ($request->hasAny(['name', 'email'])) {

#Old Input

Retrieve input from the previous request

$username = $request->old('username');

Or use the old() helper

<input type="text" name="username" value="{{ old('username') }}">

See: Helpers
See: Forms

#Uploaded Files

Retrieve uploaded file from request

$file = $request->file('photo');

$file = $request->photo;

Get file path or extension

$path = $request->photo->path();

$extension = $request->photo->extension();

Store uploaded file with a randomly generated filename

// path where the file should be stored relative to
// the filesystem's configured root directory
$path = $request->photo->store('images'); 

// optional 2nd param to specify the filesystem disk
$path = $request->photo->store('images', 's3');

Store uploaded file and specify the name

$path = $request->photo->storeAs('images', 'filename.jpg');

$path = $request->photo->storeAs('images', 'filename.jpg', 's3');

See More: Laravel File Storage



<!-- View stored in resources/views/greeting.blade.php -->

        <h1>Hello, <?php echo $name; ?></h1>

Create a view by placing a file with the .blade.php extension in the resources/views directory.

#Pass Data to Views

#As an array

return view('greetings', ['name' => 'Victoria']);

#Using with()

return view('greeting')
            ->with('name', 'Victoria')
            ->with('occupation', 'Astronaut');

Access each value using the data's keys

        <h1>Hello, {{ $name }}</h1>
        <!-- Or -->
        <h1>Hello, <?php echo $name; ?></h1>

#view helper

Return a view from a route with the view() helper

Route::get('/', function () {
    return view('greeting', ['name' => 'James']);

See: View Routes and Helpers


// resources/views/admin.profile.blade.php
return view('admin.profile');

#Blade Templates


Blade is the templating engine included in Laravel that also allows you to use plain PHP.


Blade views are returned using the view() helper

Route::get('/', function () {
    return view('welcome', ['name' => 'Samantha']);

See: Views


{{-- This comment will not be present in the rendered HTML --}}


#if Statements

@if (count($records) === 1)
    I have one record!
@elseif (count($records) > 1)
    I have multiple records!
    I don't have any records!

#isset & empty

    // $records is defined and is not null...

    // $records is "empty"...


    // The user is authenticated...

    // The user is not authenticated...


@for ($i = 0; $i < 10; $i++)
    The current value is {{ $i }}

@foreach ($users as $user)
    <p>This is user {{ $user->id }}</p>

@forelse ($users as $user)
    <li>{{ $user->name }}</li>
    <p>No users</p>

@while (true)
    <p>I'm looping forever.</p>

Loop Iteration:

@foreach ($users as $user)
    @if ($loop->first)
        This is the first iteration.

    @if ($loop->last)
        This is the last iteration.

    <p>This is user <!--swig7--></p>

See more: Laravel Loop Variable

#Displaying Data

Blade's echo statements {{ }} are automatically sent through PHP's htmlspecialchars function to prevent XSS attacks.

Display the contents of the name variable:

Hello, {{ $name }}.

Display results of a PHP function:

The current UNIX timestamp is {{ time() }}.

Display data without escaping with htmlspecialchars

Hello, {!! $name !!}.

#Including Subviews

Include a Blade view from within another view.
All variables that are available to the parent view are also available to the included view

    <!-- resources/views/shared/errors/blade.php -->

        <!-- Form Contents -->

#Raw PHP

Execute a block of plain PHP

    $counter = 1;


Blade allows you to push to named stacks which can be rendered in another view or layout.
Useful for javascript libraries required by child views

<!-- Add to the stack -->
    <script src="/example.js"></script>

Render the stack

    <!-- Head Contents -->


Prepend to the beginning of a stack

    This will be second...

// Later...

    This will be first...


#CSRF Field

Include a hidden CSRF token field to validate the request

<form method="POST" action="/profile">

See: CSRF Protection

#Method Field

Since HTML forms can't make PUT, PATCH, or DELETE requests, you will need to add a hidden _method field to spoof these HTTP verbs:

<form action="/post/my-post" method="POST">


#Validation Errors

<!-- /resources/views/post/create.blade.php -->

<label for="title">Post Title</label>

<input id="title" type="text" class="@error('title') is-invalid @enderror">

    <div class="alert alert-danger">{{ $message }}</div>

See: Validation

#Repopulating Forms

When redirecting due to a validation error, request input is flashed to the session.
Retrieve the input from the previous request with the old method

$title = $request->old('title');

Or the old() helper

<input type="text" name="title" value="{{ old('title') }}">



If validation fails, a redirect response to the previous URL will be generated.
If the incoming request is an XHR request, a JSON response with the validation error messages will be returned.


// in routes/web.php
Route::get('/post/create', [App\Http\Controllers\PostController::class, 'create']);
Route::post('/post', [App\Http\Controllers\PostController::class, 'store']);

// in app/Http/Controllers/PostController...
public function store(Request $request)
    $validated = $request->validate([
        // input name => validation rules
        'title' => 'required|unique:posts|max:255',
        'body' => 'required',

    // The blog post is valid...


Can also be passed as an array

$validatedData = $request->validate([
    'title' => ['required', 'unique:posts', 'max:255'],
    'body' => ['required'],


Field must be a value after a given date.

'start_date' => 'required|date|after:tomorrow'

Instead of a date string, you may specify another field to compare against the date

'finish_date' => 'required|date|after:start_date'

See before:date


Field must be a value after or equal to the given date.
See after:date


Field must be a value preceding the given date.
The name of another field may be supplied as the value of date.
See after:date


Field must be entirely alpha-numeric characters


Field must be able to be cast as a boolean.
Accepted input are true, false, 1, 0, "1", and "0"


Field must have a matching field of {field}_confirmation.
For example, if the field is password, a matching password_confirmation field must be present


Field must match the authenticated user's password.


Field must be a valid, non-relative date according to the strtotime PHP function.


Field must be formatted as an email address.


Field must be a successfully uploaded file.
See: Uploaded Files


Field must be less than or equal to a maximum value.
Strings, numerics, arrays, and files are evaluated like the size rule.


Field must have a minimum value.
Strings, numerics, arrays, and files are evaluated like the size rule.


File must match one of the given MIME types:

'video' => 'mimetypes:video/avi,video/mpeg,video/quicktime'

File's contents will be read and the framework will attempt to guess the MIME type, regardless of the client's provided MIME type.


Field must have a MIME type corresponding to one of the listed extensions.

'photo' => 'mimes:jpg,bmp,png'

File's contents will be read and the framework will attempt to guess the MIME type, regardless of the client's provided MIME type.

Full listing of MIME types & extensions


Field may be null.


Field must be numeric.


Field must match the authenticated user's password.


Field must be empty or not present.


Field must be empty or not present if the anotherfield field is equal to any value.


Field must be empty or not present unless the anotherfield field is equal to any value.


Field must be present in the input data and not empty.
A field is considered "empty" if one of the following conditions are true:

  • The value is null.
  • The value is an empty string.
  • The value is an empty array or empty Countable object.
  • The value is an uploaded file with no path.


Field must be present and not empty, only if any of the other specified fields are present and not empty


Field must have a size matching the given value.

  • For strings: number of characters
  • For numeric data: integer value (must also have the numeric or integer rule).
  • For arrays: count of the array
  • For files: file size in kilobytes
// Validate that a string is exactly 12 characters long...
'title' => 'size:12';
// Validate that a provided integer equals 10...
'seats' => 'integer|size:10';
// Validate that an array has exactly 5 elements...
'tags' => 'array|size:5';
// Validate that an uploaded file is exactly 512 kilobytes...
'image' => 'file|size:512';


Field must not exist within the given database table


Field must be a valid URL

See all available rules

#Validate Passwords

Ensure passwords have an adequate level of complexity

$validatedData = $request->validate([
    'password' => ['required', 'confirmed', Password::min(8)],

Password rule object allows you to easily customize the password complexity requirements

// Require at least 8 characters...

// Require at least one letter...

// Require at least one uppercase and one lowercase letter...

// Require at least one number...

// Require at least one symbol...

Ensure a password has not been compromised in a public password data breach leak


Uses the k-Anonymity model via the haveibeenpwned.com service without sacrificing the user's privacy or security

Methods can be chained


#Display Validation Errors

<!-- /resources/views/post/create.blade.php -->

<h1>Create Post</h1>

@if ($errors->any())
    <div class="alert alert-danger">
            @foreach ($errors->all() as $error)

<!-- Create Post Form -->

See: Validation Errors

#Optional Fields

You will often need to mark your "optional" request fields as nullable if you do not want the validator to consider null values as invalid

// publish_at field may be either null or a valid date representation
    'title' => 'required|unique:posts|max:255',
    'body' => 'required',
    'publish_at' => 'nullable|date',

#Validated Input

Retrieve the request data that underwent validation

$validated = $request->validated();

Or with safe(), which returns an instance of Illuminate\Support\ValidatedInput

$validated = $request->safe()->only(['name', 'email']);

$validated = $request->safe()->except(['name', 'email']);

$validated = $request->safe()->all();


foreach ($request->safe() as $key => $value) {

#Access as an array

$validated = $request->safe();

$email = $validated['email'];



Laravel ships with a variety of session backends that are accessed through a unified API. Memcached, Redis, and database support is included.


Session configuration is in config/session.php.
By default, Laravel is configured to use the file session driver

#Check Isset / Exists

Returns true if the item is present and is not null:

if ($request->session()->has('users')) {

Returns true if present, even if it's null:

if ($request->session()->exists('users')) {

Returns true if the item is null or is not present:

if ($request->session()->missing('users')) {

#Retrieving Data

#Via Request

// ...
class UserController extends Controller
    public function show(Request $request, $id)
        $value = $request->session()->get('key');


Pass a default value as the second argument to use if the key does not exist

$value = $request->session()->get('key', 'default');

// closure can be passed and executed as a default
$value = $request->session()->get('key', function () {
    return 'default';

#Via session helper

Route::get('/home', function () {
    // Retrieve a piece of data from the session...
    $value = session('key');

    // Specifying a default value...
    $value = session('key', 'default');

    // Store a piece of data in the session...
    session(['key' => 'value']);

See: Session Helper

#All Session Data

$data = $request->session()->all();

#Retrieve and Delete

Retrieve and delete an item from the session

$value = $request->session()->pull('key', 'default');

#Store Data

Via a request instance

$request->session()->put('key', 'value');

Via the global "session" helper

session(['key' => 'value']);

Push a new value onto a session value that is an array

// array of team names
$request->session()->push('user.teams', 'developers');



Configuration options for logging behavior is in config/logging.php.
By default, Laravel will use the stack channel when logging messages, which aggregates multiple log channels into a single channel.


All the log levels defined in the RFC 5424 specification are available:

  • emergency
  • alert
  • critical
  • error
  • warning
  • notice
  • info
  • debug

#Log Facade

use Illuminate\Support\Facades\Log;


#Contextual Info

use Illuminate\Support\Facades\Log;

Log::info('User failed to login.', ['id' => $user->id]);



Ensure your web server directs all requests to your application's public/index.php file


#Composer's autoloader map

composer install --optimize-autoloader --no-dev

#Configuration Loading

Be sure that you are only calling the env function from within your configuration files.
Once the configuration has been cached, the .env file will not be loaded and all calls to the env function for .env variables will return null

php artisan config:cache

#Route Loading

php artisan route:cache

#View Loading

php artisan view:cache

#Debug Mode

The debug option in your config/app.php determines how much information about an error is actually displayed to the user.
By default, this option is set to the value of the APP_DEBUG environment variable in your .env file. In your production environment, this value should always be false.
If the APP_DEBUG variable is set to true in production, you risk exposing sensitive configuration values to end users.