Difference between #12 and #13 of
Understanding "Safe" Validation Rules

Revision #13 has been created by Gismo on Nov 29, 2012, 12:24:29 PM with the memo:

edit russian version anchor
« previous (#12)


Title unchanged

Understanding "Safe" Validation Rules

Category unchanged


Yii version unchanged

Tags unchanged

Forms, Validation, Safe, Massive Assignment, understanding

Content changed

Yii takes the conservative approach that attributes are assumed to be unsafe unless the developer explicitly makes them so (a "default deny" paradigm), rather than the easier but more dangerous "default allow".

It's wise to review the Rules in your model from time to time to ensure that you're not allowing things you should not (especially when scenarios are in play), because it's not uncommon to wildly mark things as safe during a bout of validation problems without realizing that this actaully reduces the security of the application.

Russian Version: [
The PHP TimesПравило валидации "safe", для тех, кто в танке](http://phptime.ru/blog/yii/23.html)
72 0
Viewed: 129 961 times
Version: 1.1
Category: FAQs
Written by: Steve Friedl
Last updated by: Gismo
Created on: Mar 22, 2011
Last updated: 5 years ago
Update Article


View all history