Mass assignment protection in Laravel - Mini Project: Build & Apply

Mass Assignment Protection in Laravel

📖 Scenario: You are building a simple Laravel application to manage a list of books. Each book has a title, author, and price. You want to safely create new book records from user input without accidentally allowing unwanted fields to be set.

🎯 Goal: Learn how to protect your Laravel model from mass assignment vulnerabilities by specifying which fields can be filled using mass assignment.

📋 What You'll Learn

Create a Laravel model called Book with the fields title, author, and price.

Add a $fillable property to the Book model to allow mass assignment only on title and author.

Write code to create a new Book instance using mass assignment with an array containing title, author, and price.

Ensure that the price field is not set by mass assignment and remains null or default.

💡 Why This Matters

🌍 Real World

Mass assignment protection is essential in Laravel applications to prevent users from setting sensitive or unintended model fields when submitting forms or API requests.

💼 Career

Understanding mass assignment protection helps you write secure Laravel code, a key skill for backend web developers working with PHP frameworks.

1

Create the Book model with fields

Create a Laravel model class called Book that extends Model. Add the protected properties title, author, and price as fillable fields later. For now, just define the class with no fillable property.

Laravel

<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Model;

class Book extends Model
{
    // Define the Book model class here
    // Your code here
}

Hint

Start by creating a class named Book inside the App\Models namespace that extends Laravel's Model class.

2

Add the $fillable property to allow mass assignment

Inside the Book model class, add a protected property called $fillable and set it to an array containing the strings 'title' and 'author' only.

Laravel

<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Model;

class Book extends Model
{
    // Add the $fillable property here
    // Your code here
}

Hint

The $fillable array tells Laravel which fields can be set using mass assignment. Only include 'title' and 'author'.

3

Create a new Book instance using mass assignment

Write code to create a new Book instance using mass assignment with an array containing 'title' => 'The Great Gatsby', 'author' => 'F. Scott Fitzgerald', and 'price' => 20. Assign this instance to a variable called $book.

Laravel

<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Model;

class Book extends Model
{
    protected $fillable = ['title', 'author'];
}

// Create a new Book instance with mass assignment
// Your code here

Hint

Use the new Book([...]) syntax with an array to set the fields. Include title, author, and price keys.

4

Verify mass assignment protection on the price field

Add code to check that the price property of the $book instance is not set by mass assignment. Assign null to $priceValue if $book->price is not set or is null, otherwise assign $book->price.

Laravel

 'The Great Gatsby', 'author' => 'F. Scott Fitzgerald', 'price' => 20]);

// Check if price is set by mass assignment
// Your code here

Hint

Use the null coalescing operator ?? to assign null if $book->price is not set.

Practice

1. What is the main purpose of mass assignment protection in Laravel?

easy

A. To speed up database queries automatically

B. To control which model attributes can be set in bulk

C. To encrypt user passwords before saving

D. To generate database migrations

Solution

1. Step 1: Understand mass assignment concept

   Mass assignment means setting multiple model attributes at once, often from user input.

2. Step 2: Identify protection purpose

   Mass assignment protection controls which attributes can be set this way to prevent unwanted changes.

3. Final Answer:

   To control which model attributes can be set in bulk -> Option B

4. Quick Check:

   Mass assignment protection = control allowed fields [OK]

Hint: Mass assignment protects fields from unwanted bulk changes [OK]

Common Mistakes:

• Confusing mass assignment with password encryption
• Thinking it speeds up queries
• Believing it creates migrations automatically

2. Which of the following is the correct way to allow mass assignment for the 'name' and 'email' fields in a Laravel model?

easy

A. public $fillable = ['name', 'email'];

B. protected $guarded = ['name', 'email'];

C. protected $fillable = ['name', 'email'];

D. public $guarded = ['name', 'email'];

Solution

1. Step 1: Recall correct property for allowed fields

   In Laravel, $fillable lists fields allowed for mass assignment.

2. Step 2: Check syntax and visibility

   The property should be protected and named $fillable with an array of allowed fields.

3. Final Answer:

   protected $fillable = ['name', 'email']; -> Option C

4. Quick Check:

   $fillable = allowed fields [OK]

Hint: Use $fillable to list allowed fields, not $guarded [OK]

Common Mistakes:

• Using $guarded to allow fields instead of block
• Making $fillable public instead of protected
• Confusing $fillable and $guarded names

3. Given the model below, what will happen if you try to create a user with User::create(['name' => 'Anna', 'email' => '[e-mail]', 'role' => 'admin']);?

class User extends Model {
    protected $fillable = ['name', 'email'];
}

medium

A. Error thrown because role is not fillable

B. User is created with all fields including role

C. User is created but name and email are empty

D. User is created with name and email set; role is ignored

Solution

1. Step 1: Check $fillable fields

   The model allows mass assignment only for 'name' and 'email'.

2. Step 2: Understand behavior for unfillable fields

   The 'role' field is ignored during mass assignment, no error is thrown.

3. Final Answer:

   User is created with name and email set; role is ignored -> Option D

4. Quick Check:

   Only $fillable fields set, others ignored [OK]

Hint: Only $fillable fields are set; others ignored silently [OK]

Common Mistakes:

• Expecting an error for unfillable fields
• Thinking all fields are set regardless of $fillable
• Assuming unfillable fields become null

4. You have this model:

class Post extends Model {
    protected $guarded = [];
}

You want to prevent mass assignment on the 'is_admin' field. What is the best fix?

medium

A. Add 'is_admin' to the $guarded array

B. Set $guarded = ['*'] to block all fields

C. Remove the $guarded property completely

D. Add 'is_admin' to the $fillable array

Solution

1. Step 1: Understand current $guarded setting

   Currently, $guarded is empty array, so all fields are mass assignable.

2. Step 2: Block 'is_admin' field

   To block a field, add it to $guarded array to prevent mass assignment.

3. Final Answer:

   Add 'is_admin' to the $guarded array -> Option A

4. Quick Check:

   $guarded blocks fields; add 'is_admin' there [OK]

Hint: Add fields to $guarded to block mass assignment [OK]

Common Mistakes:

• Adding blocked fields to $fillable instead
• Removing $guarded and expecting protection
• Blocking all fields unintentionally with ['*']

5. You want to allow mass assignment on all fields except 'password' and 'is_admin' in a Laravel model. Which is the best way to do this?

hard

A. protected $guarded = ['password', 'is_admin'];

B. protected $fillable = ['password', 'is_admin'];

C. protected $fillable = ['*'];

D. protected $guarded = [];

Solution

1. Step 1: Understand the goal

   Allow all fields except 'password' and 'is_admin' for mass assignment.

2. Step 2: Choose correct property

   Using $guarded to block specific fields is best for this case.

3. Step 3: Evaluate options

   Setting protected $guarded = ['password', 'is_admin']; blocks those fields and allows others.

4. Final Answer:

   protected $guarded = ['password', 'is_admin']; -> Option A

5. Quick Check:

   $guarded blocks fields; use it to exclude only some [OK]

Hint: Use $guarded to block few fields, allow all others [OK]

Common Mistakes:

• Using $fillable with only blocked fields (wrong meaning)
• Setting $fillable to ['*'] which is invalid
• Leaving $guarded empty and expecting protection