Prohibited Validation Rules in Laravel Explained with Examples

Introduction

Laravel’s validation system is one of its most powerful features. It ensures that the data entering your application is safe, reliable, and formatted correctly. While most validation rules are about allowing or restricting data formats, Laravel also provides a special set of rules called Prohibited Validation Rules.

These rules are not about requiring a value but instead about explicitly preventing the presence of certain fields. This is useful in scenarios where you want to ensure that some fields are not submitted at all under certain conditions.

In this article, we’ll explore three powerful rules in detail:

• prohibited – Always disallow a field.
• prohibited_if – Disallow a field if another field has a certain value.
• prohibited_unless – Disallow a field unless another field has a specific value.

Why Use Prohibited Validation Rules?

Imagine you are building a form where users can either choose one option or another, but not both. Or perhaps, in certain workflows, a field should never be present. Without prohibited rules, developers often relied on custom validation logic.

Laravel’s prohibited rules solve this cleanly, making your validation logic shorter, more expressive, and easier to maintain.

Some real-world examples include:

• A discount code field that should not appear if a “premium membership” is already chosen.
• An “admin” flag that should never be set by regular users.
• Ensuring mutually exclusive fields in an order form.

The prohibited Rule

The prohibited rule disallows the presence of a field entirely. If a field is submitted with any value (even empty), validation will fail.

Example Usage

// In a controller or FormRequest
$request->validate([
    'admin' => 'prohibited',
]);
    

In this case, if the request contains an admin field, validation will fail regardless of its value.

Real-World Example

Let’s say you have a public registration form. You want to ensure no one can submit an admin flag while signing up.

// RegistrationController.php
public function register(Request $request)
{
    $request->validate([
        'name' => 'required|string|max:255',
        'email' => 'required|email|unique:users',
        'password' => 'required|min:8',
        'admin' => 'prohibited',
    ]);

    User::create($request->only(['name', 'email', 'password']));
}
    

This prevents malicious users from trying to give themselves admin privileges through hidden form fields.

The prohibited_if Rule

The prohibited_if rule prohibits a field if another field has a given value. This is useful for mutually exclusive options.

Syntax

'field_name' => 'prohibited_if:another_field,value'
    

Example Usage

$request->validate([
    'discount_code' => 'prohibited_if:membership,premium',
]);
    

Here, if the membership field equals premium, then discount_code is not allowed.

Expanded Example

Consider an e-commerce checkout form:

public function checkout(Request $request)
{
    $request->validate([
        'membership' => 'required|in:basic,premium',
        'discount_code' => 'nullable|string|prohibited_if:membership,premium',
    ]);

    // Process checkout
}
    

This ensures that premium users cannot submit a discount code.

The prohibited_unless Rule

The prohibited_unless rule disallows a field unless another field has a specific value.

Syntax

'field_name' => 'prohibited_unless:another_field,value'
    

Example Usage

$request->validate([
    'vip_code' => 'prohibited_unless:membership,vip',
]);
    

Here, the vip_code field is prohibited unless membership equals vip.

Real Example

public function apply(Request $request)
{
    $request->validate([
        'membership' => 'required|in:basic,vip',
        'vip_code' => 'nullable|string|prohibited_unless:membership,vip',
    ]);

    // Logic here
}
    

This ensures that only VIP members can submit a VIP code.

Comparison Table: Prohibited Rules

Using Prohibited Rules in Form Requests

For cleaner code, you can use Form Request classes instead of inline validation.

php artisan make:request CheckoutRequest
    

In CheckoutRequest.php:

public function rules()
{
    return [
        'membership' => 'required|in:basic,premium,vip',
        'discount_code' => 'prohibited_if:membership,premium',
        'vip_code' => 'prohibited_unless:membership,vip',
    ];
}
    

This makes your controller code much cleaner and centralizes validation logic.

Chaining Prohibited Rules with Others

You can combine prohibited rules with other rules, though keep in mind that prohibited always takes priority if triggered.

$request->validate([
    'vip_code' => 'nullable|string|min:5|prohibited_unless:membership,vip',
]);
    

If membership is not VIP, the field is prohibited. If it is VIP, then vip_code must be a string with a minimum length of 5.

Error Messages for Prohibited Rules

By default, Laravel generates messages like:

• The admin field is prohibited.
• The discount code field is prohibited when membership is premium.
• The vip code field is prohibited unless membership is vip.

You can customize these in your resources/lang/en/validation.php file.

'prohibited' => 'The :attribute field is not allowed.',
'prohibited_if' => 'The :attribute field is not allowed when :other is :value.',
'prohibited_unless' => 'The :attribute field is not allowed unless :other is :value.',
    

Best Practices

• Use prohibited for security-sensitive fields (e.g., admin, is_superuser).
• Use prohibited_if when enforcing mutual exclusivity between fields.
• Use prohibited_unless to restrict fields to specific roles or options.
• Combine with FormRequest for cleaner controllers.
• Always customize error messages for better UX.

Conclusion

Laravel’s Prohibited Validation Rules offer a powerful way to enforce data restrictions beyond just requiring or formatting fields. Whether you want to prevent unauthorized fields, enforce mutual exclusivity, or ensure a field only appears under certain conditions, these rules give you expressive tools right out of the box.

By mastering prohibited, prohibited_if, and prohibited_unless, you can secure your application, simplify validation logic, and create cleaner forms for your users.