Mass assignment protection in Laravel - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is mass assignment in Laravel?

Mass assignment is a way to set multiple model attributes at once using an array, often when creating or updating a model.

beginner

Why is mass assignment protection important?

It prevents users from setting sensitive or unintended fields by restricting which attributes can be filled in bulk, protecting your app from security risks.

beginner

What property do you use in a Laravel model to allow mass assignment on specific fields?

You use the $fillable property to list the attributes that are allowed to be mass assigned.

intermediate

What happens if you try to mass assign attributes not listed in $fillable?

Laravel will ignore those attributes and not set them on the model, protecting your app from unwanted changes.

intermediate

What is the $guarded property in Laravel models?

$guarded is the opposite of $fillable. It lists attributes that should NOT be mass assignable. Setting it to an empty array means all attributes are mass assignable.

Which property in a Laravel model defines which attributes can be mass assigned?

A $fillable

B $hidden

C $casts

D $timestamps

The $fillable property lists the attributes allowed for mass assignment.

What will happen if you try to mass assign an attribute not in $fillable?

A Laravel will throw an error

B Laravel will ignore it and not assign it

C Laravel will assign it anyway

D Laravel will delete the attribute

Laravel silently ignores attributes not in $fillable to protect your app.

If you want to allow all attributes to be mass assignable, what should you set $guarded to?

A ['*']

B null

C An empty array []

D ['id']

Setting $guarded to an empty array means no attributes are guarded, so all are mass assignable.

Mass assignment protection helps prevent what kind of security issue?

A Unauthorized data modification

B SQL injection

C Cross-site scripting

D Denial of service

Mass assignment protection prevents users from changing sensitive fields they shouldn't.

Which method commonly uses mass assignment in Laravel?

A Model::all()

B Model::find()

C Model::delete()

D Model::create()

Model::create() accepts an array of attributes and uses mass assignment to set them.

Explain mass assignment protection in Laravel and how to use $fillable and $guarded properties.

Think about how you control which fields users can set when creating or updating data.

Describe a real-life example where mass assignment protection prevents a security risk in a Laravel app.

Imagine a user trying to make themselves an admin by sending extra data.

Practice

1. What is the main purpose of mass assignment protection in Laravel?

easy

A. To speed up database queries automatically

B. To control which model attributes can be set in bulk

C. To encrypt user passwords before saving

D. To generate database migrations

Solution

1. Step 1: Understand mass assignment concept

   Mass assignment means setting multiple model attributes at once, often from user input.

2. Step 2: Identify protection purpose

   Mass assignment protection controls which attributes can be set this way to prevent unwanted changes.

3. Final Answer:

   To control which model attributes can be set in bulk -> Option B

4. Quick Check:

   Mass assignment protection = control allowed fields [OK]

Hint: Mass assignment protects fields from unwanted bulk changes [OK]

Common Mistakes:

• Confusing mass assignment with password encryption
• Thinking it speeds up queries
• Believing it creates migrations automatically

2. Which of the following is the correct way to allow mass assignment for the 'name' and 'email' fields in a Laravel model?

easy

A. public $fillable = ['name', 'email'];

B. protected $guarded = ['name', 'email'];

C. protected $fillable = ['name', 'email'];

D. public $guarded = ['name', 'email'];

Solution

1. Step 1: Recall correct property for allowed fields

   In Laravel, $fillable lists fields allowed for mass assignment.

2. Step 2: Check syntax and visibility

   The property should be protected and named $fillable with an array of allowed fields.

3. Final Answer:

   protected $fillable = ['name', 'email']; -> Option C

4. Quick Check:

   $fillable = allowed fields [OK]

Hint: Use $fillable to list allowed fields, not $guarded [OK]

Common Mistakes:

• Using $guarded to allow fields instead of block
• Making $fillable public instead of protected
• Confusing $fillable and $guarded names

3. Given the model below, what will happen if you try to create a user with User::create(['name' => 'Anna', 'email' => '[e-mail]', 'role' => 'admin']);?

class User extends Model {
    protected $fillable = ['name', 'email'];
}

medium

A. Error thrown because role is not fillable

B. User is created with all fields including role

C. User is created but name and email are empty

D. User is created with name and email set; role is ignored

Solution

1. Step 1: Check $fillable fields

   The model allows mass assignment only for 'name' and 'email'.

2. Step 2: Understand behavior for unfillable fields

   The 'role' field is ignored during mass assignment, no error is thrown.

3. Final Answer:

   User is created with name and email set; role is ignored -> Option D

4. Quick Check:

   Only $fillable fields set, others ignored [OK]

Hint: Only $fillable fields are set; others ignored silently [OK]

Common Mistakes:

• Expecting an error for unfillable fields
• Thinking all fields are set regardless of $fillable
• Assuming unfillable fields become null

4. You have this model:

class Post extends Model {
    protected $guarded = [];
}

You want to prevent mass assignment on the 'is_admin' field. What is the best fix?

medium

A. Add 'is_admin' to the $guarded array

B. Set $guarded = ['*'] to block all fields

C. Remove the $guarded property completely

D. Add 'is_admin' to the $fillable array

Solution

1. Step 1: Understand current $guarded setting

   Currently, $guarded is empty array, so all fields are mass assignable.

2. Step 2: Block 'is_admin' field

   To block a field, add it to $guarded array to prevent mass assignment.

3. Final Answer:

   Add 'is_admin' to the $guarded array -> Option A

4. Quick Check:

   $guarded blocks fields; add 'is_admin' there [OK]

Hint: Add fields to $guarded to block mass assignment [OK]

Common Mistakes:

• Adding blocked fields to $fillable instead
• Removing $guarded and expecting protection
• Blocking all fields unintentionally with ['*']

5. You want to allow mass assignment on all fields except 'password' and 'is_admin' in a Laravel model. Which is the best way to do this?

hard

A. protected $guarded = ['password', 'is_admin'];

B. protected $fillable = ['password', 'is_admin'];

C. protected $fillable = ['*'];

D. protected $guarded = [];

Solution

1. Step 1: Understand the goal

   Allow all fields except 'password' and 'is_admin' for mass assignment.

2. Step 2: Choose correct property

   Using $guarded to block specific fields is best for this case.

3. Step 3: Evaluate options

   Setting protected $guarded = ['password', 'is_admin']; blocks those fields and allows others.

4. Final Answer:

   protected $guarded = ['password', 'is_admin']; -> Option A

5. Quick Check:

   $guarded blocks fields; use it to exclude only some [OK]

Hint: Use $guarded to block few fields, allow all others [OK]

Common Mistakes:

• Using $fillable with only blocked fields (wrong meaning)
• Setting $fillable to ['*'] which is invalid
• Leaving $guarded empty and expecting protection