What does "Mass Assignment" mean in Laravel?

php laravel mass-assignment
Chen-Tsu Lin picture Chen-Tsu Lin · Mar 9, 2014 · Viewed 79.1k times · Source

When I went through Laravel Document about Eloquent ORM topic part, I got a new term Mass Assignment.

Document show How to do Mass Assignment and the fillable or guarded properties settings. But after went through that, I didn't have a clearly understand about Mass Assignment and how it works.

In my past experience in CodeIgniter, I also didn't hear about this term.

Does anyone have a simple explanation about that?

Answer

duellsy picture duellsy · Mar 9, 2014

Mass assignment is when you send an array to the model creation, basically setting a bunch of fields on the model in a single go, rather than one by one, something like:

$user = new User(request()->all());

(This is instead of explicitly setting each value on the model separately.)

You can use fillable to protect which fields you want this to actually allow for updating.

You can also block all fields from being mass-assignable by doing this:

protected $guarded = ['*'];

Let's say in your user table you have a field that is user_type and that can have values of user / admin

Obviously, you don't want users to be able to update this value. In theory, if you used the above code, someone could inject into a form a new field for user_type and send 'admin' along with the other form data, and easily switch their account to an admin account... bad news.

By adding:

$fillable = ['name', 'password', 'email'];

You are ensuring that only those values can be updated using mass assignment

To be able to update the user_type value, you need to explicitly set it on the model and save it, like this:

$user->user_type = 'admin';
$user->save();

Related questions

Laravel 5 : MassAssignmentException in Model.php

I am getting this error: MassAssignmentException in Model.php line 448: _token When I am using create method. Please review code below: Contacts.php (Model): class Contacts extends Model { protected $table = ['name', 'mobile', 'email', 'address', 'created_at', 'updated_at']; } ContactsController.php (…

Read More
How Do I Get the Query Builder to Output Its Raw SQL Query as a String?

Given the following code: DB::table('users')->get(); I want to get the raw SQL query string that the database query builder above will generate. In this example, it would be SELECT * FROM users. How do I do …

Read More
How to Create Multiple Where Clause Query Using Laravel Eloquent?

I'm using the Laravel Eloquent query builder and I have a query where I want a WHERE clause on multiple conditions. It works, but it's not elegant. Example: $results = User::where('this', '=', 1) ->where('that', '=', 1) …

Read More