# Laravel FormRequest safe() method is a must-know

December 28, 2025


`$request->except()` operates on the entire request, not just validated fields. This leaves you open to mass-assignment:

```php
User::create([
    'name' => implode(' ', [$request->first_name, $request->last_name]),
    ...$request->except(['first_name', 'last_name']),
]);
```

Anyone can slip a `score` or `is_admin` field through. Use `safe()` instead:

```php
User::create([
    'name' => implode(' ', [$request->first_name, $request->last_name]),
    ...$request->safe()->except(['first_name', 'last_name']),
]);
```

`safe()->except()` excludes from the validated set and not the raw request.