Mass assignment protection in Laravel - Step-by-Step Execution

Concept Flow - Mass assignment protection

Receive user input data

↓

Attempt to create/update model with input

↓

Check model's fillable or guarded properties for each field

↓

Allow assignment

↓

Save model

↓

End process

This flow shows how Laravel checks if input data can be assigned to model fields safely, blocking any unallowed fields to protect data.

Execution Sample

Laravel

User::create(['name' => 'Ana', 'role' => 'admin']);

// In User model:
// protected $fillable = ['name'];

This code tries to create a user with name and role, but only 'name' is allowed to be mass assigned.

Execution Table

Step	Action	Input Data	Model fillable	Allowed Fields	Blocked Fields	Result
1	Receive input	{name: 'Ana', role: 'admin'}	['name']	name	role	Proceed to assign
2	Check each input field	name	['name']	Allowed	-	Assign 'Ana' to name
3	Check each input field	role	['name']	-	Blocked	Prevent assignment of 'role'
4	Create model instance	-	-	name	-	Model created with name='Ana' only
5	Save model	-	-	-	-	User saved in database
6	End	-	-	-	-	Process complete, no mass assignment error

💡 Mass assignment blocked for 'role' field because it is not in fillable array

Variable Tracker

Variable	Start	After Step 2	After Step 3	Final
inputData	{name: 'Ana', role: 'admin'}	{name: 'Ana', role: 'admin'}	{name: 'Ana', role: 'admin'}	{name: 'Ana', role: 'admin'}
fillable	[]	['name']	['name']	['name']
allowedFields	[]	['name']	['name']	['name']
blockedFields	[]	[]	['role']	['role']
modelAttributes	{}	{name: 'Ana'}	{name: 'Ana'}	{name: 'Ana'}

Key Moments - 2 Insights

Why is the 'role' field not saved even though it was in the input?

Because 'role' is not listed in the model's fillable array, Laravel blocks it to prevent mass assignment. See execution_table step 3 where 'role' is blocked.

What happens if the fillable array is empty?

No fields are allowed for mass assignment, so any attempt to assign input data will be blocked, resulting in no attributes being mass assigned. This is shown by the blockedFields tracking in variable_tracker.

Visual Quiz - 3 Questions

Look at the execution table, which field is blocked from assignment?

A both name and role

B name

C role

D none

💡 Hint

Check the 'Blocked Fields' column in execution_table row 3

At which step is the model instance created with allowed fields?

A Step 2

B Step 4

C Step 3

D Step 5

💡 Hint

Look at the 'Result' column in execution_table row 4

If 'role' was added to fillable, what would change in the execution table?

A 'role' would be allowed and assigned at step 3

B 'role' would still be blocked

C Model creation would fail

D Input data would be empty

💡 Hint

Compare 'fillable' and 'blockedFields' columns in execution_table rows 2 and 3

Concept Snapshot

Mass assignment protection in Laravel:
- Use $fillable array in model to list allowed fields
- Input fields not in $fillable are blocked
- Prevents accidental or malicious data overwrite
- Silently ignores blocked fields
- Always define $fillable or $guarded to secure models

Full Transcript

Mass assignment protection in Laravel helps keep your app safe by controlling which input fields can be assigned to your model all at once. When you try to create or update a model using an array of data, Laravel checks the model's fillable array. Only fields listed there are allowed to be assigned. Others are blocked to prevent unwanted changes. For example, if you try to assign 'name' and 'role' but only 'name' is fillable, Laravel will assign 'name' and block 'role'. This stops users from changing sensitive fields like roles or permissions by accident or attack. The process ends with the model saved with only allowed fields. Always set fillable or guarded properties in your models to keep mass assignment safe.

Practice

1. What is the main purpose of mass assignment protection in Laravel?

easy

A. To speed up database queries automatically

B. To control which model attributes can be set in bulk

C. To encrypt user passwords before saving

D. To generate database migrations

Solution

1. Step 1: Understand mass assignment concept

   Mass assignment means setting multiple model attributes at once, often from user input.

2. Step 2: Identify protection purpose

   Mass assignment protection controls which attributes can be set this way to prevent unwanted changes.

3. Final Answer:

   To control which model attributes can be set in bulk -> Option B

4. Quick Check:

   Mass assignment protection = control allowed fields [OK]

Hint: Mass assignment protects fields from unwanted bulk changes [OK]

Common Mistakes:

• Confusing mass assignment with password encryption
• Thinking it speeds up queries
• Believing it creates migrations automatically

2. Which of the following is the correct way to allow mass assignment for the 'name' and 'email' fields in a Laravel model?

easy

A. public $fillable = ['name', 'email'];

B. protected $guarded = ['name', 'email'];

C. protected $fillable = ['name', 'email'];

D. public $guarded = ['name', 'email'];

Solution

1. Step 1: Recall correct property for allowed fields

   In Laravel, $fillable lists fields allowed for mass assignment.

2. Step 2: Check syntax and visibility

   The property should be protected and named $fillable with an array of allowed fields.

3. Final Answer:

   protected $fillable = ['name', 'email']; -> Option C

4. Quick Check:

   $fillable = allowed fields [OK]

Hint: Use $fillable to list allowed fields, not $guarded [OK]

Common Mistakes:

• Using $guarded to allow fields instead of block
• Making $fillable public instead of protected
• Confusing $fillable and $guarded names

3. Given the model below, what will happen if you try to create a user with User::create(['name' => 'Anna', 'email' => '[e-mail]', 'role' => 'admin']);?

class User extends Model {
    protected $fillable = ['name', 'email'];
}

medium

A. Error thrown because role is not fillable

B. User is created with all fields including role

C. User is created but name and email are empty

D. User is created with name and email set; role is ignored

Solution

1. Step 1: Check $fillable fields

   The model allows mass assignment only for 'name' and 'email'.

2. Step 2: Understand behavior for unfillable fields

   The 'role' field is ignored during mass assignment, no error is thrown.

3. Final Answer:

   User is created with name and email set; role is ignored -> Option D

4. Quick Check:

   Only $fillable fields set, others ignored [OK]

Hint: Only $fillable fields are set; others ignored silently [OK]

Common Mistakes:

• Expecting an error for unfillable fields
• Thinking all fields are set regardless of $fillable
• Assuming unfillable fields become null

4. You have this model:

class Post extends Model {
    protected $guarded = [];
}

You want to prevent mass assignment on the 'is_admin' field. What is the best fix?

medium

A. Add 'is_admin' to the $guarded array

B. Set $guarded = ['*'] to block all fields

C. Remove the $guarded property completely

D. Add 'is_admin' to the $fillable array

Solution

1. Step 1: Understand current $guarded setting

   Currently, $guarded is empty array, so all fields are mass assignable.

2. Step 2: Block 'is_admin' field

   To block a field, add it to $guarded array to prevent mass assignment.

3. Final Answer:

   Add 'is_admin' to the $guarded array -> Option A

4. Quick Check:

   $guarded blocks fields; add 'is_admin' there [OK]

Hint: Add fields to $guarded to block mass assignment [OK]

Common Mistakes:

• Adding blocked fields to $fillable instead
• Removing $guarded and expecting protection
• Blocking all fields unintentionally with ['*']

5. You want to allow mass assignment on all fields except 'password' and 'is_admin' in a Laravel model. Which is the best way to do this?

hard

A. protected $guarded = ['password', 'is_admin'];

B. protected $fillable = ['password', 'is_admin'];

C. protected $fillable = ['*'];

D. protected $guarded = [];

Solution

1. Step 1: Understand the goal

   Allow all fields except 'password' and 'is_admin' for mass assignment.

2. Step 2: Choose correct property

   Using $guarded to block specific fields is best for this case.

3. Step 3: Evaluate options

   Setting protected $guarded = ['password', 'is_admin']; blocks those fields and allows others.

4. Final Answer:

   protected $guarded = ['password', 'is_admin']; -> Option A

5. Quick Check:

   $guarded blocks fields; use it to exclude only some [OK]

Hint: Use $guarded to block few fields, allow all others [OK]

Common Mistakes:

• Using $fillable with only blocked fields (wrong meaning)
• Setting $fillable to ['*'] which is invalid
• Leaving $guarded empty and expecting protection