Turing 042 - Don’t Panic! Use Strong Params
Hackers keep getting smarter, with more powerful and tricky machines to back them up! It’s important to stay on top of your application site security.
One of the ways we do this in Rails is to use Strong Parameters. What strong params do is to ONLY permit certain parameters to be included in a params hash (particularly when creating or updating a database record). This helps prevent attacks that try to include database manipulation such as deleting records not associated with the one the hacker is creating, OR for the hacker to try giving themselves additional permissions in your site (such as setting themselves up as an admin user).
It is convention to call upon a method that defines what these strong parameters are within the arguments passed to new and update.
user = User.new(user_params) ... def user_params params.require(:user).permit(:name, :address, :phone_number, :password_digest)
end
only the fields you set in the .permit arguments can be passed to the model.








