Laravel interview question · Most asked
What are the most common security mistakes in Laravel applications?
Summary
Mass assignment from raw input, missing authorization on endpoints, SQL injection through raw queries with interpolated values, XSS through {!! !!}, exposed debug mode or .env, and secrets committed to the repository.
Longer Answer
- Authorization: route-model binding finds any record; every action needs a policy check.
- Mass assignment: use
validated()data and$fillable. - SQL injection: Eloquent and the builder bind values, but
whereRaw("name = '$name'"),DB::statementwith interpolation and user-controlled column names (orderBy($request->sort)) are injectable. Bind values and allow-list column names. - XSS:
{{ }}escapes;{!! !!}does not. Only output trusted or sanitised HTML. - Configuration:
APP_DEBUG=truein production leaks stack traces and environment; the web root must bepublic/so.envis never served. - Uploads: validate types, store outside the web root or on private disks.
- Keep Laravel and packages updated (
composer audit).
Key Points
- Authorize every action.
- Bind values; allow-list sortable columns.
{!! !!}only for trusted HTML.APP_DEBUG=false, web rootpublic/,composer audit.
More most-asked Laravel questions
- How do you validate requests in Laravel? Why use Form Requests?
- Gates or policies: how does authorization work in Laravel?
- What is mass assignment, and how do $fillable and $guarded protect against it?
- How do database transactions work in Laravel, and what pitfalls should you know?
- Which Artisan commands would you run when deploying Laravel to production, and why?
- What is the service container, and how does dependency injection work in Laravel?
- What is the N+1 query problem in Eloquent and how do you prevent it?
- How do queues work in Laravel?