3 ms·
Is it really frowned upon to do: user.name = params[:user][‘name’] ?? Call me old fashioned, but this is called 'defensive coding' and should (in my opini
by jazzychad 15y ago
Is it really frowned upon to do:
user.name = params[:user][‘name’]
?? Call me old fashioned, but this is called 'defensive coding' and should (in my opinion) be the norm when dealing with client-generated input. It might be more verbose and not 'The Rails Way', but update_attributes seems like too much magic for my paranoid taste.
- danso 15y agoIt's not frowned upon, but it would require tighter coupling between the controller and the view...?
- jazzychad 15y agoYes, that makes sense. If your view's form should only update the user's name, then the logic that handles that form submission should only update the user's name. Allowing the client to inject other attributes (even allowed/whitelisted ones) could potentially break other app logic.