Download the PHP package tihloh/prefab-input without Composer

Prefab Input

Prefab Input turns raw/untrusted PHP input into clean, normalized, typed, validated and deeply whitelisted application data.

Define exactly what your application accepts. Everything else stays outside the validated result.

It combines closely related input-boundary concerns:

• validation;
• trimming and normalization;
• type casting;
• safe field whitelisting;
• defaults and conditional rules;
• nested arrays and wildcard paths;
• multiple/repeated form rows;
• $_FILES normalization;
• multipart file validation;
• JSON request bodies;
• custom rules and transformers;
• friendly validation errors.

Prefab Input is standalone. It does not require Routes, Database, Users, Auth, Permissions, Logs, Laravel, or another framework.

Requirements

• PHP 8.1 or newer
• ext-fileinfo for secure MIME detection
• Composer when installed as a package

Installation

When published:

1. Quick start

validated() contains only schema-declared fields that passed processing.

2. One input pipeline

Incoming values often need several steps before business logic:

Prefab Input handles this as one pipeline:

3. Schema as a whitelist

Suppose a client sends:

but the schema declares only:

Then:

returns only:

Undeclared client fields never become validated application data.

4. Compact and array schemas

Compact syntax:

Array syntax:

Array schemas can also contain callable validation rules.

5. Transformations and casting

Built-in operations include:

Example:

Validated output:

Invalid casts produce validation errors rather than silently pretending the requested type was produced.

6. Core validation rules

Built-in rules include:

7. Required, nullable, sometimes and defaults

nullable accepts an absent/null/empty value as null. sometimes ignores an absent field completely. default applies only when the field is absent.

8. Conditional validation

These rules also work inside wildcard rows when the referenced rule path uses the same wildcard positions.

Example:

For items.3.sku, Prefab compares items.3.type.

9. Nested input

Dot notation reads and writes nested arrays:

Validated output:

10. Array form inputs

PHP automatically converts HTML names such as:

into:

Process each item using *:

11. Repeated/nested rows with wildcards

HTML:

PHP produces:

Prefab schema:

Validated output:

Errors keep their concrete index:

Nested wildcards are also supported:

12. Deep whitelisting

Wildcard schemas do not copy undeclared fields from parent arrays.

Input:

Schema:

Validated output:

This makes nested client input safer to pass to application services or persistence.

13. Standard multipart forms

For normal PHP multipart/form-data requests, PHP already parses the protocol into $_POST and $_FILES.

Use:

or explicitly:

HTML:

Process it naturally:

Prefab does not reimplement the standard PHP multipart boundary parser. It normalizes PHP's already-parsed request data.

14. UploadedFile

Uploaded files become UploadedFile objects:

mime() detects MIME from temporary file contents using fileinfo; it does not simply trust the browser-provided MIME string.

UploadedFile represents temporary input only. Permanent storage is intentionally outside Prefab Input.

15. File rules

Examples:

Rules:

Supported size suffixes are b, kb, mb, and gb.

Dimension examples:

16. Multiple file uploads

HTML:

Prefab normalizes PHP's column-oriented $_FILES representation into:

Then:

17. Nested multipart rows

HTML can mix ordinary fields and files:

Schema:

$_POST and $_FILES are merged into one logical nested input tree before validation.

18. JSON requests

Input::fromRequest() detects Content-Type: application/json and reads php://input automatically:

Invalid JSON produces a clear exception instead of silently converting the request into empty data.

Raw multipart parsing for unusual non-standard request flows can later belong to an HTTP transport layer; Prefab Input remains focused on input normalization and validation.

19. Result object

process() returns InputResult:

Meaning:

Prefer validated() when passing request data into application services.

20. Friendly attributes and messages

Wildcard pattern messages/attributes apply to their concrete paths unless an even more specific concrete key is configured.

21. Custom rules

Custom rule callbacks receive field, current value, raw data, parsed parameters and existence state.

This is also the extension point for database-aware unique/exists behavior without making Prefab Database mandatory.

22. Inline callable rules

Return null when valid, or a non-empty error string when invalid.

23. Custom transformations

Custom transformers receive the current value, parameters, field name and raw data.

24. Database-aware rules without a hard dependency

A future Database adapter may provide reusable resolvers while the Input core stays database-independent.

25. Responsibility boundary

Prefab Input owns the incoming-data boundary:

It deliberately does not own permanent file storage, directories, cloud storage, public URLs, database persistence, HTTP responses, or routing.

A future file-storage package could consume UploadedFile without changing Input itself.

26. API quick reference

InputResult:

UploadedFile:

27. Design philosophy

Prefab Input stays simple for ordinary forms:

The same API scales to large dynamic forms and APIs:

The core principle is: turn untrusted external data into predictable application data without forcing a framework or persistence layer.