Mass Assignment & Fillable / Guarded
Mass assignment protection prevents users from setting unauthorized fields via request input. Define $fillable (whitelist) or $guarded (blacklist) on your model to control which attributes can be set via create() or update().
Mass Assignment Protection
class User extends Model
{
// WHITELIST approach (recommended)
protected $fillable = ['name', 'email', 'password'];
// Only these fields can be mass-assigned
// User::create($request->all()) is safe
// OR BLACKLIST approach
protected $guarded = ['is_admin', 'role'];
// Everything EXCEPT these can be mass-assigned
// Empty guarded = allow everything (DANGEROUS)
// protected $guarded = [];
}
// Why it matters:
// Without protection, a malicious user could send:
// POST /register {name: 'Hacker', email: '...', is_admin: true}
// And make themselves an admin!Best Practice
Always use $fillable (whitelist) over $guarded (blacklist). With $fillable, new columns are protected by default - you must explicitly allow them. With $guarded, new columns are unprotected by default, which is a security risk. When using create() or update() with user input, only pass validated data: Post::create($request->validated()) - this combines Laravel validation with mass assignment protection for defense in depth.
Route::resource generates all 7 CRUD routes with one line
Industry Best Practices
- Always write tests for this functionality - it's the most reliable way to catch regressions when you refactor or update packages
- Document your implementation decisions in code comments, especially when you deviate from Laravel conventions - future team members (including yourself) will thank you
- Follow the single responsibility principle: each class does one thing. If a method grows beyond 20 lines, consider extracting helper methods or moving logic to a service class
- Profile performance with Laravel Debugbar (composer require barryvdh/laravel-debugbar) during development - it shows query counts, memory usage, and timeline for every request
- Keep dependencies up to date: run composer audit regularly to check for security vulnerabilities in your package dependencies
Industry Best Practices
- Always write tests for this functionality - it's the most reliable way to catch regressions when you refactor or update packages
- Document your implementation decisions in code comments, especially when you deviate from Laravel conventions - future team members (including yourself) will thank you
- Follow the single responsibility principle: each class does one thing. If a method grows beyond 20 lines, consider extracting helper methods or moving logic to a service class
- Profile performance with Laravel Debugbar (composer require barryvdh/laravel-debugbar) during development - it shows query counts, memory usage, and timeline for every request
- Keep dependencies up to date: run composer audit regularly to check for security vulnerabilities in your package dependencies
Industry Best Practices
- Always write tests for this functionality - it's the most reliable way to catch regressions when you refactor or update packages
- Document your implementation decisions in code comments, especially when you deviate from Laravel conventions - future team members (including yourself) will thank you
- Follow the single responsibility principle: each class does one thing. If a method grows beyond 20 lines, consider extracting helper methods or moving logic to a service class
- Profile performance with Laravel Debugbar (composer require barryvdh/laravel-debugbar) during development - it shows query counts, memory usage, and timeline for every request
- Keep dependencies up to date: run composer audit regularly to check for security vulnerabilities in your package dependencies
Tip
Tip
Practice Mass Assignment Fillable Guarded in small, isolated examples before integrating into larger projects. Breaking concepts into small experiments builds genuine understanding faster than reading alone.
Practice Task
Note
Practice Task - (1) Write a working example of Mass Assignment Fillable Guarded from scratch without looking at notes. (2) Modify it to handle an edge case (empty input, null value, or error state). (3) Share your solution in the Priygop community for feedback.
Quick Quiz
Common Mistake
Warning
A common mistake with Mass Assignment Fillable Guarded is skipping edge case testing - empty inputs, null values, and unexpected data types. Always validate boundary conditions to write robust, production-ready laravel code.
Key Takeaways
- Mass assignment protection prevents users from setting unauthorized fields via request input.
- Always write tests for this functionality - it's the most reliable way to catch regressions when you refactor or update packages
- Document your implementation decisions in code comments, especially when you deviate from Laravel conventions - future team members (including yourself) will thank you
- Follow the single responsibility principle: each class does one thing. If a method grows beyond 20 lines, consider extracting helper methods or moving logic to a service class