In Laravel, what do the global TrimStrings and ConvertEmptyStringsToNull middleware do to request input, and how do you exclude a field or request?

## Two input normalisers on the global stack Laravel's default global stack ends with two middleware that rewrite user input before any route or controller sees it: 1. `Illuminate\Foundation\Http\Middleware\TrimStrings` 2. `Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull` Both extend `TransformsRequest`, which walks three parameter bags and rewrites each value in place: - the **query string** (`$request->query`), - the **JSON body** when the request is JSON, - otherwise the **form body** (`$request->request`). Nested arrays are walked recursively, with keys joined by dots (`options.0.label`). Route parameters, headers, cookies and uploaded files are **not** touched. ## TrimStrings Every string value is passed through `Str::trim()`. Unlike PHP's `trim()`, `Str::trim()` also removes Unicode whitespace and invisible characters such as zero-width spaces, which users paste from word processors more often than you would expect. Three keys are never trimmed by default, because a password may legitimately start or end with a space: - `password` - `password_confirmation` - `current_password` ## ConvertEmptyStringsToNull Every value that is exactly `''` becomes `null`. Because it runs **after** `TrimStrings`, a field containing only spaces is first trimmed to `''` and then converted to `null`. ## What this changes for a voting app A poll-creation form has a required `title`, an optional `description` and a list of `options`: | Submitted value | After TrimStrings | After ConvertEmptyStringsToNull | |---|---|---| | `" Best lunch spot "` | `"Best lunch spot"` | `"Best lunch spot"` | | `" "` | `""` | `null` | | `""` | `""` | `null` | | `"0"` | `"0"` | `"0"` | Consequences you meet in practice: - The `required` rule rejects a whitespace-only title, because it now arrives as `null`. - An optional field must be validated as `nullable`, or a rule such as `string` fails on the `null`. - A database column receiving an optional field must accept `NULL`, or the insert fails. - Code that compares `$request->input('description') === ''` never matches. ## Excluding fields and requests Both behaviours are configured in `bootstrap/app.php` through the `Middleware` configurator: ```php ->withMiddleware(function (Middleware $middleware): void { $middleware->trimStrings(except: [ 'ballot_note', // key pattern fn (Request $request) => $request->is('webhooks/*'), // skip whole request ]); $middleware->convertEmptyStringsToNull(except: [ fn (Request $request) => $request->is('webhooks/*'), ]); }) ``` - `trimStrings(except:)` accepts both **strings** and **closures**. Strings are key patterns matched with `Str::is()`, so wildcards and dotted nested keys work; they add to the default password keys rather than replacing them. Closures receive the request and, when they return `true`, skip trimming for the entire request. - `convertEmptyStringsToNull(except:)` accepts **closures only**; there is no per-key exclusion. - Webhook endpoints are a common reason to skip both, so the handler sees payload values exactly as the sender produced them; signature checks themselves should hash the raw body, which these middleware never modify. ## Where they sit and why that matters Both run on the **global** stack, before routing, so they apply to web routes, API routes and even requests that end in a 404. `TrimStrings` runs before `ConvertEmptyStringsToNull`, and both run after `ValidatePostSize`. Everything downstream, including route middleware, form requests and controllers, sees the normalised values, because they replace the originals in the request's parameter bags; only the raw body from `$request->getContent()`, and PHP's own superglobals, still hold what was sent. ## Testing the behaviour - A feature test that posts `['title' => ' ']` to the poll-creation route should receive a validation error for `title`, proving the whitespace was trimmed and converted. - A test posting `['ballot_note' => ' keep ']` after excluding the key should see the spaces preserved in the stored record. ## Removing them entirely If an application genuinely wants raw input everywhere, `$middleware->remove(ConvertEmptyStringsToNull::class)` takes the class off the global stack. That is rarely a good idea: validation rules, nullable columns and form handling across the codebase are usually written assuming the normalised values.