Arr::only
Returns just the given keys from an array, dropping everything else.
public static function only($array, $keys)Parameters
| Parameter | Type | Description |
|---|---|---|
$$array | array | The source array to take a subset of. |
$$keys | array|string | The keys to keep. A single string key is accepted and cast to a one-element array. |
Return value
arrayA new array containing only the requested keys that actually exist, in the source array's original order.
Arr::only is a whitelist. It is implemented as array_intersect_key($array, array_flip((array) $keys)), which explains every one of its behaviours.
When to reach for it
- Narrowing a request payload to the fields you are willing to mass-assign, before handing it to a model or a service.
- Trimming a large config or API response down to the handful of keys a view actually needs.
- Building a stable cache key or log line from a subset of a larger array.
What trips people up
The output order follows the source array, not the order you listed the keys in. Asking for ['price', 'name'] from an array declared name first gives you name first. If order matters, build the array yourself.
Missing keys are silently dropped, not filled with null. A key you asked for that was absent simply is not in the result, so count() on the output can be smaller than count($keys). Use array_key_exists or a merge with defaults if you need every key present.
There is no dot notation. Unlike Arr::get or Arr::pull, only works purely on top-level keys; 'user.name' matches a literal key spelled user.name, not a nested one.
Example
When to use it
- Whitelist request input to the fields a form is allowed to update.
- Reduce a verbose API response to the three keys a view template reads.
- Strip internal or sensitive keys from an array before writing it to a log.
Frequently asked questions
Does Arr::only support dot notation for nested keys?
No. It only matches top-level keys, so 'user.name' looks for a literal key spelled that way. Use Arr::get or data_get for nested access.
What is the difference between Arr::only and Arr::except?
Arr::only is a whitelist that keeps the keys you name; Arr::except is a blacklist that removes them. Prefer only when handling untrusted input, since anything new the client sends is excluded by default.
Why is my result in a different order than the keys I asked for?
Because Arr::only uses array_intersect_key, which preserves the order of the first array. Build the array manually if the output order matters.
More examples
Guaranteeing every key is present
The first result has two keys, the second has four. array_fill_keys plus array_merge is the standard way to turn Arr::only's "whatever exists" contract into a guaranteed shape.
<?php
use Illuminate\Support\Arr;
$input = ['name' => 'Desk', 'price' => 100];
$wanted = ['name', 'price', 'description', 'sku'];
// Arr::only alone leaves out what was never there.
print_r(Arr::only($input, $wanted));
// Merge defaults in when the caller needs a fixed shape.
$defaults = array_fill_keys($wanted, null);
print_r(array_merge($defaults, Arr::only($input, $wanted)));
/*
Array
(
[name] => Desk
[price] => 100
)
Array
(
[name] => Desk
[price] => 100
[description] =>
[sku] =>
)
*/Whitelisting input in a controller
Shows the whitelist role in context: whatever else was posted, only the three named keys survive. $request->only() does the same thing for request objects; Arr::only is what you use once the data is already a plain array.
<?php
namespace App\Http\Controllers;
use Illuminate\Http\Request;
use Illuminate\Support\Arr;
class ProfileController extends Controller
{
public function update(Request $request)
{
$data = $request->all();
// Only these three keys may ever reach the model.
$safe = Arr::only($data, ['name', 'email', 'timezone']);
// 'is_admin' and 'password' submitted by a crafted form are gone.
$request->user()->update($safe);
return back();
}
}
Discussion