Difference between attr_accessor and attr_accessible

by

attr_accessor is a Ruby method that makes a getter and a setter. attr_accessible is a Rails method that allows you to pass in values to a mass assignment: new(attrs) or update_attributes(attrs).

Here’s a mass assignment:

Order.new({ :type => 'Corn', :quantity => 6 })

You can imagine that the order might also have a discount code, say :price_off. If you don’t tag :price_off as attr_accessible you stop malicious code from being able to do like so:

Order.new({ :type => 'Corn', :quantity => 6, :price_off => 30 })

Even if your form doesn’t have a field for :price_off, if it’s in your model it’s available by default. This means a crafted POST could still set it. Using attr_accessible white lists those things that can be mass assigned.

More Related Contents:

  1. Boolean Validation
  2. Format a string containing Phone numbers
  3. SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed
  4. How to understand nil vs. empty vs. blank in Ruby
  5. How do I parse JSON with Ruby on Rails? [duplicate]
  6. Best way to create custom config options for my Rails app?
  7. Rails params explained?
  8. Save image from URL by paperclip
  9. Why does String#gsub double content?
  10. What is Rack middleware?
  11. rescue_from ActionController::RoutingError in Rails 4
  12. Rails 4: before_filter vs. before_action
  13. query , can not select column count
  14. Why are all Rails helpers available to all views, all the time? Is there a way to disable this?
  15. How to use bundler behind a proxy?
  16. Uploading multiple files with paperclip
  17. Rails 3.1 and Ruby 1.9.3p125: ruby-debug19 still crashes with “Symbol not found: _ruby_threadptr_data_type” [duplicate]
  18. Best Practices for reusing code between controllers in Ruby on Rails
  19. How to change the default path of view files in a Rails 3 controller?
  20. How do I set up the database.yml file in Rails?
  21. Why use “self” to access ActiveRecord/Rails model properties?
  22. Converting string from snake_case to CamelCase in Ruby
  23. Converting an array of objects to ActiveRecord::Relation
  24. Controller spec unknown keyword: id
  25. Rails – Sort by join table data
  26. strong parameters permit all attributes for nested attributes
  27. Installing Ruby on Rails – Mac OS Lion
  28. Ruby: Create range of dates
  29. Is the server running on host “localhost” (::1) and accepting TCP/IP connections on port 5432?
  30. Unable to install MySQL2 gem on Windows 7

Leave a Comment