Bypassing $fillable Safely with forceFill() in Laravel

July 2, 2025

Bypassing $fillable Safely with forceFill() in Laravel

Ever used create() in Laravel and noticed some fields like role or status didn’t save? That’s because Laravel’s mass assignment protection silently ignores non-whitelisted attributes.

🔐 What Is Mass Assignment?

Mass assignment lets you set multiple model attributes in one go, e.g.:

User::create([
  'name' => 'John',
  'email' => '[email protected]',
  'role' => 'admin', // This won’t get saved if not fillable
]);

🛡️ Two Ways to Control Fillable Fields

1. $fillable (Whitelist)

protected $fillable = ['name', 'email'];

Only listed fields are allowed for mass assignment.

2. $guarded (Blacklist)

protected $guarded = ['role'];

Everything is fillable except the blacklisted attributes.

⚡ Enter forceFill()

When you trust your data source (e.g., from an internal service, seeder, or job), you can bypass fillable/guarded protection using:

$user = new User;

$user->forceFill([
  'name' => 'John',
  'email' => '[email protected]',
  'role' => 'admin',  // Will be assigned regardless of $fillable
])->save();

No need to adjust your $fillable or $guarded, and it's safe when used properly.

✔️ When to Use Each

  • ✅ $fillable: For trusted user input (forms, APIs).
  • ✅ $guarded: When many fields are fillable except a few.
  • ✅ forceFill(): For backend logic with trusted data.

Using create() without understanding mass assignment may result in “missing fields” — use the right tool for the job. Laravel is powerful when used with understanding.

Blog

React Native 0.81: A Quantum Leap in Development Environment Efficiency

Jan 27, 2026

Introduction React Native is one of the most widely used frameworks for cross-platform mobile application development. However, iOS build time ha...

How OAuth Works

Jun 29, 2025

How OAuth Works OAuth is a protocol that allows third-party applications to access user data without sharing passwords. It's the backbone of secure a...

Stop Copy-Pasting Code! Learn How to Use Traits in Laravel the Right Way

Jul 01, 2025

🚫 Stop Copy-Pasting Code! Ever duplicated slug logic or logging across multiple models? Laravel's Traits got your back. 1. What’s a Trait?...

Explore the Most Powerful Modern Laravel Tools: Inertia.js, View Creators, and HLS — Step by Step

Jul 27, 2025

Here’s a complete breakdown of essential tools to level up your Laravel development: Inertia.js v2, View Creators, and the Laravel HLS package...

Using Web Components the Smart Way

Jul 06, 2025

Using Web Components the Smart Way A lot of developers assume Web Components are meant to replace full SPA frameworks like React or Vue. But in rea...

Load JavaScript on Demand to Boost Site Performance

Jul 24, 2025

🧠 What is Dynamic Import? Dynamic import allows you to load JavaScript modules at runtime—only when needed. This approach is fantastic for r...