validation - 在 Yii 中执行 "massive assignment"时是否执行验证？

Question

我读过一篇文章 "Understanding "Safe" Validation Rules"

作者说:

Key Point - Massive Assignment will only be made for fields which have passed some explicit validation rule. The obvious "actual" validators - length, email, required, etc. - all qualify, but some fields are free form and optional, and don't have any format requirements - the user can put whatever he likes, including leaving it blank.

但是有一个comment :

I admit I haven't taken the time to confirm this thoroughly, but as far as I remember, you are not correct in lumping the validation in with the assignment. If memory serves correctly, when you do massive assignment ($model->setAttributes($_POST['Model'])), no actual validation takes place. Rather, for each attribute in the POST/GET array, the model checks whether that attribute is safe for assignment (by checking whether there is a validation or safe rule for that attribute, without actually validating it) - if there is then it sets the attribute, if not it ignores it.

Validation only takes place when you call $model->save() (or explicitly $model->validate()), when the attributes that have already been assigned are checked using the validation rules.

It is also worth mentioning that massive assignment and individual assignment are not actually equivalent - massive assignment checks whether there is a validation or safe rule for each attribute, whereas if you make an individual assignment ($model->attribute = $_POST['Model']['attribute'];) no such check is made - Yii assumes that the attribution is trusted.

那么，任何人都可以证明哪一个是正确的？

Answer 1

一个字段只有在其类型不是“不安全”的验证规则时才可以被大量赋值。然而，它并未在大规模分配时得到验证。

它在您调用 validate() 或调用 save(true) 时被验证。

不要忘记您可以直接在他们的类引用中阅读 Yii 源代码