Eloquent - What is $fillable really for?

Question

This is what Laravel document sais :

To get started, you should define which model attributes you want to make mass assignable. You may do this using the $fillable property on the model

So why not just let all the attributes to be assigned by the ->fill()/::create() methods?

Answer 1

Software frameworks sometime allow developers to automatically bind HTTP request parameters into program code variables or objects to make using that framework easier on developers. This can sometimes cause harm.

Attackers can sometimes use this methodology to create new parameters that the developer never intended which in turn creates or overwrites new variable or objects in program code that was not intended.

This is called a Mass Assignment vulnerability.

And laravel provider fillable for mass-assignment vulnerability, it is a white-list for fields.

A mass-assignment vulnerability occurs when a user passes an unexpected HTTP parameter through a request, and that parameter changes a column in your database you did not expect. For example, a malicious user might send an is_admin parameter through an HTTP request, which is then passed into your model's create method, allowing the user to escalate themselves to an administrator.