Bypassing $fillable Safely with forceFill() in Laravel

July 2, 2025

Bypassing $fillable Safely with forceFill() in Laravel

Ever used create() in Laravel and noticed some fields like role or status didn’t save? That’s because Laravel’s mass assignment protection silently ignores non-whitelisted attributes.

🔐 What Is Mass Assignment?

Mass assignment lets you set multiple model attributes in one go, e.g.:

User::create([
  'name' => 'John',
  'email' => '[email protected]',
  'role' => 'admin', // This won’t get saved if not fillable
]);

🛡️ Two Ways to Control Fillable Fields

1. $fillable (Whitelist)

protected $fillable = ['name', 'email'];

Only listed fields are allowed for mass assignment.

2. $guarded (Blacklist)

protected $guarded = ['role'];

Everything is fillable except the blacklisted attributes.

⚡ Enter forceFill()

When you trust your data source (e.g., from an internal service, seeder, or job), you can bypass fillable/guarded protection using:

$user = new User;

$user->forceFill([
  'name' => 'John',
  'email' => '[email protected]',
  'role' => 'admin',  // Will be assigned regardless of $fillable
])->save();

No need to adjust your $fillable or $guarded, and it's safe when used properly.

✔️ When to Use Each

  • ✅ $fillable: For trusted user input (forms, APIs).
  • ✅ $guarded: When many fields are fillable except a few.
  • ✅ forceFill(): For backend logic with trusted data.

Using create() without understanding mass assignment may result in “missing fields” — use the right tool for the job. Laravel is powerful when used with understanding.

Blog

How to Make Your Website Blazing Fast – Step by Step

Jul 30, 2025

Why Performance Is Non-Negotiable In today’s fast-paced world, no one has time to wait for a slow-loading website. On mobile, users abandon...

Stop Copy-Pasting Code! Learn How to Use Traits in Laravel the Right Way

Jul 01, 2025

🚫 Stop Copy-Pasting Code! Ever duplicated slug logic or logging across multiple models? Laravel's Traits got your back. 1. What’s a Trait?...

Understanding Laravel Eloquent Through Advanced OOP in PHP

Oct 14, 2026

Introduction When you write a short line in Laravel to fetch data from the database, it looks simple: $users = User::where('active', 1)->get();...

Bypassing $fillable Safely with forceFill() in Laravel

Jul 02, 2025

Bypassing $fillable Safely with forceFill() in Laravel Ever used create() in Laravel and noticed some fields like role or status didn’t save? T...

react-native-audio-api: Handling Audio in React Native Apps

Oct 15, 2026

Introduction While developing an application with React Native, you might need to play an audio file or record user audio—tasks easily handle...

Request Lifecycle in Laravel

May 23, 2026

The Journey of a Request Inside Laravel: The Core Concept and Complete Lifecycle A deep dive into how Laravel processes requests from start to...