Download the PHP package infocyph/reqshield without Composer

🛡️ ReqShield

Fast, modern PHP request validation and sanitization. Schema-based rules, fail-fast execution, intelligent batching, and 107 built-in validation rules.

✨ Features

• 🚀 107 Built-in Rules - Basic types, conditional rules, files, database checks, and more
• 🧹 46 Built-in Sanitizers - Manual sanitization or built-in sanitize+validate pipeline
• ⚡ Intelligent Batching - Expensive DB checks are batched automatically
• 🎯 Fail-Fast + Full Collection Modes - Per-field fail-fast with configurable behavior
• 🔗 Nested + Wildcard Validation - Dot notation with wildcard expansion
• 🧾 Custom Messages + Placeholders - :field, :rule, :min, and more
• 🌍 Locale Packs - Per-rule localized message templates with fallback
• 🧠 Failure Metadata - Structured failures (field, rule, message, value)
• 📦 Schema Fragments + Composition - Reuse validation contracts across endpoints
• 🔁 Conditional Closures - sometimes() and when() for dynamic rule activation
• 🧱 Schema Export - JSON Schema, OpenAPI shape, and introspection metadata
• 🧰 Typed Output + DTO Mapping - Cast map + toDTO() support
• 📤 Uploaded File Object Support - Array-style uploads and PSR-7 style objects
• 🛡️ Upload Hardening Rules - safe_filename, upload_meta, upload_id, secure_file
• 🛠️ PHP 8.4+ - Built with modern PHP features

📦 Installation

Requirements: PHP 8.4+ and ext-hash with xxh3 support

🚀 Quick Start

Basic Validation

Sanitization

Manual sanitization:

Or built-in sanitize+validate pipeline:

Or use the helper:

📚 Available Rules (107)

ReqShield includes 107 validation rules covering several common scenarios:

• Basic Types
• Formats
• Strings
• Numbers
• Dates
• Conditionals
• Database
• Files
• Arrays
• Comparison
• Patterns
• Additional

📖 View Complete Rule Reference

Upload Hardening Rules

Use upload-focused rules for request metadata and filename safety:

secure_file combines file and upload_meta so you can enforce payload validity and safe upload metadata in one rule.

🧹 Available Sanitizers (46 Built-in)

ReqShield includes 46 built-in sanitizers covering several common scenarios:

• Basic Types
• Case Conversions
• Text Processing
• Special Formats
• Alphanumeric Filters
• Security & HTML
• Encoding
• Array Operations

📖 View Complete Sanitizer Reference

🎯 Advanced Features

Nested Validation

Validate deeply nested arrays using dot notation:

Use enableNestedValidation(false) to flatten only required paths for large nested payloads.

Custom Field Names

Make error messages user-friendly:

Custom Messages + Locale Packs

Throw Exceptions on Failure

Failure Metadata for APIs

Conditional Rules

Schema Fragments

Typed Output + DTO

Custom Rules (Simple)

Use callbacks for quick custom validation:

Custom Rules (Advanced)

Create reusable rule classes:

Database Validation

Validate against your database:

Benefits:

• 🚀 Automatic batching - Multiple checks become one query
• 🎯 Update support - unique:users,email,5 ignores ID 5
• 🧾 Soft-delete aware unique - unique:users,email,,id,false,deleted_at

Schema Export / Introspection

Stop on First Error

For maximum performance, stop all validation on first error:

⚡ Performance

ReqShield is built for speed:

1. Cost-Based Rule Sorting

Rules automatically execute in order of complexity:

• Cheap (< 50): Type checks, empty checks
• Medium (50-99): String operations, regex
• Expensive (100+): Database queries, API calls

2. Intelligent Batching

Database rules are automatically batched:

3. Fail-Fast Execution

Stops validating a field on first rule failure:

4. Zero Overhead for Simple Cases

Nested validation only activates if you use dot notation. No performance cost for simple flat arrays.

🧪 Development Commands

composer benchmark runs the PhpBench suite in benchmarks/ValidatorBench.php.

📄 License

ReqShield is open-sourced software licensed under the MIT license.

🌟 Show Your Support

If you find ReqShield helpful, please consider giving it a ⭐️ on GitHub!