Validator 'safe'?

Question

Yii

I recently started studying Yii, and I just can’t understand the meaning of this validator, that is, there is such a description in the class description - The CSafeValidator validator marks related attributes as safe so that they can be assigned in batches.
But unfortunately this is not clear to me, could you explain to me with your fingers, or with examples when you need to use this type of validator.

Answer 1

www.yiiframework.com/doc/guide/1.1/en/form.model
It's very simple. This is such a thing that allows the framework to understand that the given model attribute that came from the attributes (cmodel::attributes) is allowed to be assigned to model attributes without validation . This thing must be used with care.
e.g. $model->attributes = $_POST['Article'];

Answer 2

Yes. The same thing will happen.
And I highly recommend you. do not use safe, it should be used when you need to process it with before/afterValidate. And use unsafe when, on the one hand, you need to validate an element before writing, and on the other hand, do not give the opportunity to write it through attributes.

Answer 3

If you try to assign unsafe then Cmodel->validate() will return true anyway, Warning unsafe will be in the logs and this property will not be assigned - why?
1) In Yii applications, they do what is called massive assigment - $model->attributes = $_POST['User']
The model has system properties like isNewRecord, primaryKey, scenario.
If an attacker assigns $_POST['User']['scenario'], then it is not known what can happen in the application - this is the reason why safe \ unsafe are generally separated.
2) The next attack option is to send in a post request, for example $_POST['User']['is_admin']=1

when to use this type of validator.

For example for fields in mysql of type TEXT/LONGTEXT

Answer 4

In a simple way, I would write the answer like this: use the safe validator when you don’t care what value the validated attribute can take on mass assignment :)