Difference between #6 and #13 of
Understanding "Safe" Validation Rules

Changes

Title unchanged

Understanding "Safe" Validation Rules

Category unchanged

FAQs

Yii version unchanged

Tags changed

Forms, Validation, Safe, Massive Assignment, understanding

Content changed

A common source of confusion among new Yii users is how the `'safe'` validator works, how it works with other validators, and why it's necessary in the first place. This article means to clear up this confusion, as well as explain the notion of Massive Assignment. Summary: A model's validation rules serve **two** purposes: 1. IEnsure that fields entered in a form are entered properly
2. Define which form fields are allowed to be assigned to a $model variable
[...]
Validation Rules
----------------
The obvious purpose for validators is to iensure that users enter good data into application forms.

If a field should be no more than 16 characters long, if it should reflect a unique value in a table, or it must look like an email address, Yii provides a rich set of validators to help enforce form validation.
[...]
Because Yii is protecting you from security surprises.

Though it may seem obvious to accept all the fields built into a form, during the controller's action (where Massive Assignment is taking place), Yii has no way of knowing which actual fields were part of a the form. and which are from a bad guy who is **synthesizing** form input with a contrived POST in order to fool the application.

This is protecting against two scenarios:
[...]
Yii takes the conservative approach that attributes are assumed to be unsafe unless the developer explicitly makes them so (a "default deny" paradigm), rather than the easier but more dangerous "default allow".

It's wise to review the Rules in your model from time to time to iensure that you're not allowing things you should not (especially when scenarios are in play), because it's not uncommon to wildly mark things as safe during a bout of validation problems without realizing that this actaully reduces the security of the application.
 
 
Russian Version: [Правило валидации "safe", для тех, кто в танке](http://phptime.ru/blog/yii/23.html)
75 0
46 followers
Viewed: 186 642 times
Version: 1.1
Category: FAQs
Tags: Forms, Massive Assignment, Safe, understanding, validation
Written by: Steve Friedl
Last updated by: Gismo
Created on: Mar 22, 2011
Last updated: 12 years ago
Update Article
Revert to #6 | Revert to #13

Revisions

View all history