---
title: "Accept only the fields you expect · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/mass-assignment
updated: 2026-10-20
licence: "All rights reserved"
---

# Accept only the fields you expect

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)
- Rule: Copy only named fields from a request into a record. Never save the whole request body.
- How: List the fields each form or API may change. Ignore or reject the rest. Keep fields such as `role`, `price` and `owner_id` out of every list a user can reach.
- Check: Update a test user's profile with an extra `"role": "admin"` field. The role stays the same.

Example:

```js
// Bad
await db.users.update(id, req.body);
// Good
const { name, phone } = req.body;
await db.users.update(id, { name, phone });
```

```python
# Python: copy named fields only
changes = {field: body[field] for field in ("name", "phone") if field in body}
users.update(user_id, changes)
```

```php
// PHP with Laravel
$user->update($request->only(['name', 'phone']));
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/mass-assignment`.

- Previous: [Make password resets safe](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/password-reset)
- Next: [Verify every token](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/token-checks)
- [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)