title: Laravel hidden attributes. e.g. Password - security
body: <p>According to <a href="http://laravel.com/docs/eloquent">http://laravel.com/docs/eloquent</a>, one can Hide Attributes From Array Or JSON Conversion by using a protected $hidden variable in the Model.</p>
  
  <pre><code>class User extends Eloquent {
      protected $hidden = array('password');
  }
  </code></pre>
  
  <p>Great, however when running <code>print_r(User::all())</code> the encrypted password is sent from server to client inside the User object.</p>
  
  <p>This is not just restricted to print_r(), if the specific user is queried, <code>$user-&gt;password</code> will display the encrypted password in the view.</p>
  
  <p>Is there a way of stopping this? Every time my user object is queried, the password will sent with it as part of the data, even though it doesn't need to be.</p>
  
  <pre><code>Illuminate\Database\Eloquent\Collection Object
  (
  [items:protected] =&gt; Array
      (
          [0] =&gt; User Object
              (
                  [hidden:protected] =&gt; Array
                      (
                          [0] =&gt; password
                      )
  
                  [connection:protected] =&gt; 
                  [table:protected] =&gt; 
                  [primaryKey:protected] =&gt; id
                  [perPage:protected] =&gt; 15
                  [incrementing] =&gt; 1
                  [timestamps] =&gt; 1
                  [attributes:protected] =&gt; Array
                      (
                          [id] =&gt; 1
                          [email] =&gt; admin@admin.com
                          [first_name] =&gt; Admin
                          [last_name] =&gt; User
                          [password] =&gt; $2y$10$7Wg2Wim9zHbtGQRAi0z6XeapJbAIoh4RhEnVXvdMtFnwcOh5g/W2a
                          [permissions] =&gt; 
                          [activated] =&gt; 1
                          [activation_code] =&gt; 
                          [activated_at] =&gt; 
                          [last_login] =&gt; 
                          [persist_code] =&gt; 
                          [reset_password_code] =&gt; 
                          [created_at] =&gt; 2013-09-26 10:24:23
                          [updated_at] =&gt; 2013-09-26 10:24:23
                      )
  </code></pre>