Add [_token] to fillable property to allow mass assignment

Level 58

The _token and _method fields are automatically added to all forms in Laravel as a security measure to prevent cross-site request forgery (CSRF) attacks. To allow mass assignment of these fields, you need to add them to the fillable property in your model.

To fix the error, update your Game model to include _token and _method in the fillable property:

class Game extends Model
{
  use HasFactory;
  protected $fillable = ['name', 'altname', 'system', '_token', '_method'];
}

This will allow Laravel to mass assign the _token and _method fields when updating the Game model.

Note that you should only add fields to the fillable property if you trust the source of the data. If you're accepting user input, you should validate the input first to ensure that it's safe to mass assign.

1 like

Level 1

Okay, now I'm getting SQLSTATE[42S22]: Column not found: 1054 Unknown column '_token' in 'field list' which means I am supposed to remove _method and _token from the request array before mass assignment?

Level 6

Hello.

You try to update each property that comes from the request, which is pretty bad practice.

You should validate your data and update only the validated keys with its values.

Also I don't think that you need a DB transaction for such a simple update query.

Level 1

Mass assignment is bad practise? How so?
What makes you think my code is finished yet? There is nothing wrong with testing requests and adding validation afterwards.
DB transactions are a safe way to do it. If you have a better approach, show the code including explanation.

...and feel free to figure out what this thread is actually about and suggest a solution to the actual issue. Thanks.

Level 6

Do you accept help?

$request->all() is bad practice

DB transactions should be used when you try to do more complex stuff like updating more than 1 table in the same chunk of code/ request and you need consistency for your data. If you think that's safe for what you want to do right now, happy over engineering then.

suggest a solution to the actual issue.:

Validate your data and pass the validated data to the update method.

Level 1

@Ninj4df

Do you accept help?

No, that's because I'm asking in a forum for help facepalm

$request->all() is bad practice

Interesting. So you're saying the official Laravel doc is full of bad practise? See e.g. https://laravel.com/docs/9.x/requests#input or https://laravel.com/docs/9.x/eloquent#mass-assignment Moreover, your reason for "bad practise" is still missing.

DB transactions should be used when you try to do more complex stuff

I actually do update more than 1 table but not in this minimal example for the forum question.

Validate your data and pass the validated data to the update method.

...and this will solve the issue of SQLSTATE[42S22]: Column not found: 1054 Unknown column '_token' in 'field list'? Or will this prevent Laravel to send _method and _token with the request?

Level 6

Anyway

protected $guarded = ['id']

It means that only id will not be able to get mass assigned.

if you go to mass assign a _token property, it will try to add it on the database normally.

and this will solve the issue of SQLSTATE[42S22]: Column not found: 1054 Unknown column '_token' in 'field list'

So, YES

khanalpride

Level 21

You can just use

// $request->all();   // It will get all data from request
$request->except(['_token', '_method']);   // use this to exclude _token and _method

1 like

Level 6

@khanalpride ->only() would be a better option on this specific case, so the opposite.

using except or all, is always prone to security risks on this case, that's why I told that guy about "bad practices" but he didn't want to listen

what if a user intercepts the request and adds a created_at attribute? (think of adding something more important) boom, he just tricked your "best practice" request.