Uploading Files and Validating Uploads

File uploads — profile pictures, documents, attachments — are a common requirement in real applications, and Laravel provides a clean, consistent way to accept and validate them before anything gets saved.

Accepting a File Upload

A file input in an HTML form must include the enctype="multipart/form-data" attribute, or the file simply won't be sent. On the Laravel side, the uploaded file is accessible through the request object as an instance of Laravel's file class, which wraps helpful metadata like original name and size.

Validating Uploaded Files

Just like any other form input, uploaded files should be validated before being trusted or stored. Laravel includes several rules specifically for files, covering type, size, and even image dimensions.

Good Practices for Uploads

• Always validate file type and size before processing an upload
• Never trust the original filename as safe to use directly
• Generate a new, unique filename when storing an uploaded file

Once a file passes validation, it needs somewhere to actually live — which raises the question of where Laravel stores files, and the difference between its public and storage folders.