avoid using request()->all() about laravel-best-practices HOT 5 CLOSED

Thank you for the recommendation. $request->all() is safe if you're using validation and the $fillable property properly.

In newer versions of the Laravel framework you can use $request->validate(), I'll add it to the repository a bit later.

from laravel-best-practices.

well, idk if i getting a mistake or something. if i'm wrong, please tell me where i getting wrong ... please checkout my demo project. he is a collaborative news submission.

• https://github.com/gpedro/avoid-request-all-laravel-best-practices

setup: composer install && php artisan migrate --seed

paths:

• home - GET /
• news form - GET /news/create

steps to reproduce:

• go to home and look the news inserted by the factory.
• go to news form and submit a news
• back to home and confirm is the news created on last step is not listed.
• go to news form and fill all fields and inspect element and add a field named published with value 1 and submit
• back to home and confirm is the news created on last step is listed.

notes:

• published field should be in fillable because we can have a feature to publish.

from laravel-best-practices.

an possible solution is set value manually on controller to override. but if i have a default value on database i can just pass null.

#before
News::create($request->all());

#after
$data = $request->all();
$data['published'] = false;
News::create($data);

/ping @alexeymezenin

from laravel-best-practices.

/ping @alexeymezenin

from laravel-best-practices.

Just remove published from $fillable is okay.
$fillable is for mass assignment.
Setting values of non-fillable properties in this way still works.

$news->published = true;
$news->save();

from laravel-best-practices.