How to validate current, new, and new password confirmation in Laravel 5?

There's a Hash::check() function which allows you to check whether the old password entered by user is correct or not.

usage

if (Hash::check("param1", "param2")) {
 //add logic here
}

param1 - user password that has been entered on the form
param2 - old password hash stored in database

it will return true if old password has been entered correctly and you can add your logic accordingly

for new_password and new_confirm_password to be same, you can add your validation in form request like

'new_password' => 'required',
'new_confirm_password' => 'required|same:new_password'

If you only need the functionality of a custom rule once throughout your application, you may use a Closure instead of a rule object. The Closure receives the attribute's name, the attribute's value, and a $fail callback that should be called if validation fails

$request->validate([
    'new_password' => 'required|confirmed|min:4',
    'current_password' => ['required', function ($attribute, $value, $fail) use ($user) {
        if (!\Hash::check($value, $user->password)) {
            return $fail(__('The current password is incorrect.'));
        }
    }],
]);

https://laravel.com/docs/5.6/validation#using-closures

In Laravel 6 there is a new rule called password ,according to docs

The field under validation must match the authenticated user's password. You may specify an authentication guard using the rule's first parameter:
'password' => 'password:api'

so the validation rules can be as simple as :

'current_password' => 'required|password',
'password' => 'required|string|min:8|confirmed',