Laravel表单数据处理两种方法对比：哪种更优？

两种方法说明 #

方法1：验证后使用验证数据创建 #

$validatedData = $request->validate([
    "customer_id"               => "required|integer|exists:users,id",
    "request_id"                => "required|integer|exists:requests,id",
    "addressInfo.city"          => "required|string|max:255",
    "addressInfo.district"      => "required|string|max:255",
    "addressInfo.neighborhood"   => "required|string|max:255",
    "addressInfo.addressDetail" => "nullable|string|max:500",
    "description"               => "required|string|max:500",
    "files.*"                   => "nullable|file|mimes:jpeg,png,jpg,pdf|max:2048",
]);

$company = getCurrentCompany();
$customer = $company->customers()->findOrFail($validatedData['customer_id']);
$request = $customer->requests()->findOrFail($validatedData['request_id']);
$photos = [];

// File upload processing
foreach ($request->files ?? [] as $index => $file) {
    if ($request->hasFile('files.' . $index)) {
        $photos[] = [
            'index' => $index,
            'file'  => $request->file('files.' . $index)->store('keyRequests/photos')
        ];
    }
}

// Prepare extra data
$validatedData['photos'] = $photos;
$validatedData['requester_model'] = 'App\Models\Company';
$validatedData['status'] = KeyRequest::getStatuses()[0];
$validatedData['company_id'] = $company->id;
$validatedData['request_address_id'] = $request->address->id;
$validatedData['deed_id'] = $request->deed->id;

// Create key request
$createData = Arr::except($validatedData, ['confirmation', 'files', 'redirectToEdit']);
$keyRequest = $customer->keyRequests()->create($createData);

方法2：直接使用Request创建 #

$validatedData = $request->validate([
    "customer_id"               => "required|integer|exists:users,id",
    "request_id"                => "required|integer|exists:requests,id",
    "addressInfo.city"          => "required|string|max:255",
    "addressInfo.district"      => "required|string|max:255",
    "addressInfo.neighborhood"   => "required|string|max:255",
    "addressInfo.addressDetail" => "nullable|string|max:500",
    "description"               => "required|string|max:500",
    "files.*"                   => "nullable|file|mimes:jpeg,png,jpg,pdf|max:2048",
]);

$company = getCurrentCompany();
$customer = $company->customers()->findOrFail($validatedData['customer_id']);
$request = $customer->requests()->findOrFail($validatedData['request_id']);
$photos = [];

// File upload processing
foreach ($request->files ?? [] as $index => $file) {
    if ($request->hasFile('files.' . $index)) {
        $photos[] = [
            'index' => $index,
            'file'  => $request->file('files.' . $index)->store('keyRequests/photos')
        ];
    }
}

// Prepare extra data
$request['photos'] = $photos;
$request['requester_model'] = 'App\Models\Company';
$request['status'] = KeyRequest::getStatuses()[0];
$request['company_id'] = $company->id;
$request['request_address_id'] = $request->address->id;
$request['deed_id'] = $request->deed->id;

// Create key request
$keyRequest = $customer->keyRequests()->create($request->except(['confirmation', 'files', 'redirectToEdit']));

技术疑问与解答 #

1. 哪种方法更安全，是Laravel开发中的首选方案？ #

方法1是Laravel开发中的首选，安全性更高：

• $validatedData仅包含你明确验证过的字段，而$request对象包含所有请求参数，包括未验证的隐藏字段、恶意注入的额外参数。即使使用except()过滤，也可能遗漏未预期参数，若模型$fillable配置不当，会导致意外写入数据库。
• 基于验证后的数据构建创建参数，符合最小权限原则，能有效避免Mass Assignment漏洞，确保只有允许的字段被写入。

2. 两种方法之间是否存在性能差异？ #

性能差异可以忽略不计。两者核心逻辑一致，仅数据来源不同：

• 方法1操作验证后的数组，方法2操作Request对象的参数集合，两者在数组/集合操作上的性能开销几乎无区别，不会影响应用性能。

3. 一般来说，每种方法分别适合应用在哪些场景中？ #

• 方法1（验证数据创建）：适合绝大多数业务场景，尤其是涉及数据库写入的核心业务逻辑，比如用户提交表单创建订单、提交申请等，优先保证数据安全性和可控性。
• 方法2（直接用Request创建）：仅适合简单、无敏感数据的场景，比如快速原型开发，或确认请求中不存在未验证危险参数的情况。但即使在这些场景，也建议优先使用方法1，养成良好编码习惯。

内容的提问来源于stack exchange，提问作者Madkhix