What is mass assignment, and how do $fillable and $guarded protect against it?

Summary

Mass assignment is creating or updating a model from an array, such as User::create($request->all()). Without protection, a client can set columns it should never control, like is_admin or balance.

Longer Answer

$fillable is an allow-list of attributes that may be mass assigned; $guarded is a deny-list ($guarded = [] disables protection entirely). Laravel silently drops attributes that are not fillable (or throws if you enable Model::preventSilentlyDiscardingAttributes()).

Model-level protection is the second line of defence. The first is to never pass raw input: validate with a Form Request and pass $request->validated() (or $request->safe()->only([...])), so only fields you validated reach the model.

Prefer $fillable over $guarded: a new sensitive column added later is protected by default.

Code Example

class Order extends Model
{
    protected $fillable = ['shipping_address', 'notes'];
}

public function update(UpdateOrderRequest $request, Order $order)
{
    $this->authorize('update', $order);
    $order->update($request->validated());
}

Key Points

• Mass assignment = filling a model from an array.
• $fillable (allow-list) is safer than $guarded.
• Pass validated() data, never $request->all().

Deep dive: Code Clinic: review a Laravel orders controller