Laravel - 在 laravel model 中使用或不使用可填充？

Question

I want to use this code: Model::update($request); , However all fields in the table might be modified by a malicious user so I change the $fillable in the model to modify only the ones that user can modify not others. But now the problem is that I can't modify it myself by own values.

id  name  verified
1   Alex     0

if the data the malicious user sends inside $request is:

[
    'name' => 'ModifiedAlex',
    'verified' => 1,
]

so it will modify the table and get verified that is not good And when setting $fillable to only name:

$fillable = [
    'name'
];

then I myself can't modify that with Model::where('id', $userId)->update(['verified' => 1]) .

What to do then? Use $fillable or not?

Answer 1

Keep using fillable and eloquent for the malicious users.

You can use Query Builder to avoid the fillable for yourself. It doesn't check the fillable .:

DB::table('users')->where('id', $userId)->update(['verified' => 1]); // update with verified.

Answer 2

You can update records by object

$user = \App\User::find(1);
$user->verified = 1;
$user->save();

Where user is giving data you can use Model::where('id', $userId)->update($request->except('_token')) so it avoids any other fields.

$request->except('_token') gives you all the post data except the _token index

But for admin you can use save on object to update / create users