Laravel CSRF Token handle in form save, the correct use

Question

i'm doing a laravel 8 course and the teacher is explaining a simple crud. in one part he said that in the forms we have to include @csrf for that laravel accept the form, i understand that, but in the controller he said that first we have to exclude that field from the form post with:

$data = request()->except('_token')

is this the correct way to save the form data to the db? do laravel need that token for something more in that point? or we can trash the token?

Answer 1

csrf is used only by middleware to prevent vulnerability called ( csrf ), you can read more about it like this, https://owasp.org/www-community/attacks/csrf . in your case you take all data from the request expect this token because you dont need this anymore. you should use fillable array to insert specific column in your table to protect yourself from miss assignment. like this https://laravel.com/docs/8.x/eloquent#mass-assignment .