# Attr\_accessible :field - obj.field="xxx" still possible?!

**URL:** <https://www.ruby-forum.com/t/attr-accessible-field-obj-field-xxx-still-possible/177223>\
**Category:** Rails\
**Created:** [October 13, 2009, 7:25pm UTC](https://www.ruby-forum.com/t/attr-accessible-field-obj-field-xxx-still-possible/177223 "2009-10-13T19:25:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\
**Post date:** [October 13, 2009, 7:25pm UTC](https://www.ruby-forum.com/t/attr-accessible-field-obj-field-xxx-still-possible/177223/1 "2009-10-13T19:25:59Z")

</div>

Hi all

MyClass \< ActiveRecord::Base  
attr\_protected :field  
end

In script/console:

x = MyClass.find 1

# =\> field = “original”

x.field=“blah”

# =\> “blah”

x.save

# =\> …

x = MyClass.find 1

# =\> field = “original”

Why is there still a field=() method (even though it doesn’t work when  
saving the object), when I have set it to protected?

Thanks  
Josh

---

<div class="post-metadata">

**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\
**Post date:** [October 13, 2009, 7:32pm UTC](https://www.ruby-forum.com/t/attr-accessible-field-obj-field-xxx-still-possible/177223/2 "2009-10-13T19:32:20Z")

</div>

On Oct 13, 6:25 pm, Joshua M. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> x.field=“blah”
> 
> # =\> “blah”
> 
> x.save
> 
> # =\> …
> 
> x = MyClass.find 1
> 
> # =\> field = “original”
> 
> Why is there still a field=() method (even though it doesn’t work when  
> saving the object), when I have set it to protected?

because that’s not what attr\_protected is supposed to do - it is only  
supposed to stop the field getting updated when you do  
object.update\_attributes(…) and similar. why the save isn’t working  
for you is another issue.

Fred

---

<div class="post-metadata">

**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\
**Post date:** [October 13, 2009, 7:35pm UTC](https://www.ruby-forum.com/t/attr-accessible-field-obj-field-xxx-still-possible/177223/3 "2009-10-13T19:35:40Z")

</div>

> because that’s not what attr\_protected is supposed to do - it is only  
> supposed to stop the field getting updated when you do  
> object.update\_attributes(…) and similar. why the save isn’t working  
> for you is another issue.

OK, so it is normal, that every field in the database has its own getter  
and, method whether it is protected or not, right? Thanks.

---

<div class="post-metadata">

**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\
**Post date:** [October 13, 2009, 10:51pm UTC](https://www.ruby-forum.com/t/attr-accessible-field-obj-field-xxx-still-possible/177223/4 "2009-10-13T22:51:48Z")

</div>

Joshua M. wrote:  
[…]

> Now I just redeclared the field=(str) method to be private. Would you  
> suggest this to be a clean way to “unset” the method?

No. If you want to do that, use remove\_method or undef\_method.

## Best,

Marnen Laibow-Koser  
[http://www.marnen.org](http://www.marnen.org)  
removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\
**Post date:** [October 13, 2009, 9:03pm UTC](https://www.ruby-forum.com/t/attr-accessible-field-obj-field-xxx-still-possible/177223/5 "2009-10-13T21:03:42Z")

</div>

Joshua M. wrote:

> > because that’s not what attr\_protected is supposed to do - it is only  
> > supposed to stop the field getting updated when you do  
> > object.update\_attributes(…) and similar. why the save isn’t working  
> > for you is another issue.
> 
> OK, so it is normal, that every field in the database has its own getter  
> and, method whether it is protected or not, right? Thanks.

Now I just redeclared the field=(str) method to be private. Would you  
suggest this to be a clean way to “unset” the method?