kla/php-activerecord — pull request #287 by Rican7 (2013-04-17 20:46:25+00:00)
Title: Security Issue - All Attributes Accessible/Settable by Mass Assignment

Last year, a massive security issue was found in **Rails** by a russian programmer, that allowed relationships to be changed and insecure data to be entered.
(for the whole story, go here: https://gist.github.com/peternixey/1978249)

The flaw has since been fixed in Rail's [ActiveRecord, by this commit](https://github.com/rails/rails/commit/06a3a8a458e70c1b6531ac53c57a302b162fd736) and in Laravel's ["Eloquent", with this commit](https://github.com/laravel/framework/commit/314fa7fdf95c729bfab00e4f79263ba8fb69ae4b).

**PHP-ActiveRecord** has the ability to mass assign properties similar to these other ORM's, so it also has the same security vulnerability. After MUCH consideration and debate, it was decided that all attributes should be guarded by default.

This change should be implemented into php-activerecord, or most developers could naively write very insecure apps with this library.