What does “Mass Assignment” mean in Laravel?

Question

When I went through Laravel Document about Eloquent ORM topic part, I got a new term "Mass Assignment".

Document show How to do Mass Assignment and the $fillable or $guarded properties settings. But after went through that, I didn't have a clearly understand about "Mass Assignment" and how it works.

In my past experience in CodeIgniter, I also didn't hear about this term.

Does anyone have a simple explanation about that?

Answer 1

Mass assignment is when you send an array to the model creation, basically setting a bunch of fields on the model in a single go, rather than one by one, something like:

$user = new User(request()->all());

(This is instead of explicitly setting each value on the model separately.)

You can use fillable to protect which fields you want this to actually allow for updating.

You can also block all fields from being mass-assignable by doing this:

protected $guarded = ['*'];

Let's say in your user table you have a field that is user_type and that can have values of user / admin

Obviously, you don't want users to be able to update this value. In theory, if you used the above code, someone could inject into a form a new field for user_type and send 'admin' along with the other form data, and easily switch their account to an admin account... bad news.

By adding:

$fillable = ['name', 'password', 'email'];

You are ensuring that only those values can be updated using mass assignment

To be able to update the user_type value, you need to explicitly set it on the model and save it, like this:

$user->user_type = 'admin';
$user->save();

Answer 2

Mass assignment is a process of sending an array of data that will be saved to the specified model at once. In general, you don’t need to save data on your model on one by one basis, but rather in a single process.

Mass assignment is good, but there are certain security problems behind it. What if someone passes a value to the model and without protection they can definitely modify all fields including the ID. That’s not good.

Let's say you have 'students' table, with fields "student_type, first_name, last_name”. You may want to mass assign "first_name, last_name" but you want to protect student_type from being directly changed. That’s where fillable and guarded take place.

Fillable lets you specify which fields are mass-assignable in your model, you can do it by adding the special variable $fillable to the model. So in the model:

class Student extends Model {
      protected $fillable = ['first_name', 'last_name']; //only the field names inside the array can be mass-assign
} 

the 'student_type' are not included, which means they are exempted.

Guarded is the reverse of fillable. If fillable specifies which fields to be mass assigned, guarded specifies which fields are not mass assignable. So in the model:

class Student extends Model {
      protected $guarded = ['student_type']; //the field name inside the array is not mass-assignable
}

you should use either $fillable or $guarded - not both.

For more details open link:- Mass Assignment

Answer 3

Mass assignment means you are filling a row with more than one column using an array of data. (somewhat of a shortcut instead of manually building the array) using Input::all().

Technically just from the top of my head. Fillable means what columns in the table are allowed to be inserted, guarded means the model can't insert to that particular column.

Notice that when you try to do a mass assignment with like, insert to a column named "secret", and you have specified that it is guarded, you can try to insert to it via the model, but it will never really get inserted into the database.

This is for security, and protection on your table when using the model. Mass assignment seems to be just a notice or warning that you didn't tell the model which are fillable and guarded and makes it vulnerable to some kind of attacks.

Answer 4

This is when an array of data received is saved at once in a model.

Because of the security issues with this method in laravel, it's recommended you define the fields you wish the requested data to populate on the Model.

You can use the $fillable variable to define the fields you want to populate on the database table.

E.g

Protected $fillable = [‘username’, ‘dob’, ‘email’,];

When laravel detects you are mass assigning data, it forces you to define the fields you want to mass assign in the model class.

Someone can easily pass unwanted data into an html form to your database.

Answer 5

There are two ways to handle this.

Laravel Eloquent provides an easy way to achieve this.
In your model class, add $fillable property and 
specify names of columns in the array like below:

You can achieve this by adding $guarded property in model class:

You can either choose $fillable or $guarded but not both.