$fillable and $guarded don't work when use update()?

[hms5232]

Hi, I use Laravel 8.41.0 and I have a question: Why $fillable and $guarded don't work when I use update() to update data?

I have a table named groups, and it has id, name, created_at and updated_at columns.

Now I added protected $guarded = ['created_at', 'updated_at']; in model Group.

In controller, I use

Group::create([
            'name' => $request->input('name'),
            'updated_at' => "1999-10-22 10:23:09",]);

the updated_at will not be inserted through mass assignment.

Another, if i use save() method, $guarded will work fine and the updated_at will not be affected :

Group::where('id', $id)->first()->fill([
            'name' => $request->input('name'),
            'updated_at' => "1999-10-22 10:23:09",])->save();

But, when using update(), both $grarded and $fillable don't work:

Group::where('id', $id)->update([
           'name' => $request->input('name'),
           'updated_at' => "1999-10-22 10:23:09",])

the updated_at had changed to 1999-10-22 10:23:09! Also happened in replace $grarded to $fillable.

According to docs, it should work but actually not.

Anything I missing?

English is not my native language; please excuse typing errors. Thanks very much!

Update: even try upgrade Laravel to 8.66.0, it is still.

[dennisprudlo]

Mass assignment only works with eloquent models. When calling update on a query builder instance no eloquent model is received and laravel doesn't know whats in the fillable and guarded property.

// Calling update on a builder will simply execute an update query
// -> "update `groups` set `name` = ?, `updated_at` = ? where `id` = ?"
$builder = Group::where('id', $id); // Illuminate\Database\Eloquent\Builder
$builder->update(...);

// When first retrieving an eloquent model a select query will retrieve the data, then hydrate it into an eloquent model
// and then you can do all sorts of stuff, like updating the model
$model = Group::firstWhere('id', $id); // App\Models\Group
$model->update(...);

In the second example mass assignment is applied. So if you really need mass assignment you will have to retrieve the model first. Keep in mind that this will in result in 2 queries (one for the select and one for the update):

Group::firstWhere('id', $id)->update([
    'name' => $request->input('name'),
    'updated_at' => "1999-10-22 10:23:09"
]);

Updating multiple records will result in n+1 (one query to select all groups and than one update for each group):

Group::all()->each->update([
    'updated_at' => now()
]);

If you have 100 groups this will also hydrate 100 eloquent models. While update for multiple groups on the query builder will results in only one query and no hydrations:

Group::query()->update([
    'updated_at' => now()
]);

If you want to utilize mass assignment but don't want 101 queries and 100 hydrations you can filter out the inputs you don't want:

$guarded = (new Group)->getGuarded();
$data = [
    'name' => $request->input('name'),
    'updated_at' => "1999-10-22 10:23:09"
];
$data = collect($data)
    ->reject(fn ($value, $key) => in_array($key, $guarded))
    ->toArray();

Group::query()->update($data);

[hms5232]

Thank you very much! There are many things for me to learn.