# Attr\_protected and id

**URL:** <https://www.ruby-forum.com/t/attr-protected-and-id/84978>\
**Category:** Rails\
**Created:** [February 8, 2007, 11:27pm UTC](https://www.ruby-forum.com/t/attr-protected-and-id/84978 "2007-02-08T23:27:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![PeteSalty](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bc79bd/32.png) [@PeteSalty](https://www.ruby-forum.com/u/PeteSalty)\
**Post date:** [February 8, 2007, 11:27pm UTC](https://www.ruby-forum.com/t/attr-protected-and-id/84978/1 "2007-02-08T23:27:22Z")

</div>

Is it necessarty to protect the autogenerated id of an object from  
mass assignment in each model. i.e.do I have to do this:

attr\_protected :id

in each model if I don’t want users to be able to override the id of  
an object?

Dale

---

<div class="post-metadata">

**Author:** ![PeteSalty](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bc79bd/32.png) [@PeteSalty](https://www.ruby-forum.com/u/PeteSalty)\
**Post date:** [February 8, 2007, 11:46pm UTC](https://www.ruby-forum.com/t/attr-protected-and-id/84978/2 "2007-02-08T23:46:23Z")

</div>

Try it and see for yourself.

ruby script/console

> > x = YourFavoriteModel.find(:first)  
> > =\> your object
> 
> > x.update\_attributes(:id =\> 2)  
> > =\> true
> 
> > x.id  
> > =\> ??

---

<div class="post-metadata">

**Author:** ![PeteSalty](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bc79bd/32.png) [@PeteSalty](https://www.ruby-forum.com/u/PeteSalty)\
**Post date:** [February 9, 2007, 12:09am UTC](https://www.ruby-forum.com/t/attr-protected-and-id/84978/3 "2007-02-09T00:09:27Z")

</div>

Well, this kind of answers the question. What about for things like  
x.attributes(params[:x]), or do they all work in the same way? If I  
use

x.id = 3  
x.save

it is updated, but if I use

x.update\_attributes(:id =\> 3)

it isn’t updated. How are we to know which update methods work this  
way and which don’t (does the parameter denote mass updating) ? The  
documentation is kind of deficient here

Assuming they all work in the same way (and we all know how assuming  
works out), then the follow up question would be how do you allow id  
to be mass updated?

Dale

---

<div class="post-metadata">

**Author:** ![PeteSalty](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bc79bd/32.png) [@PeteSalty](https://www.ruby-forum.com/u/PeteSalty)\
**Post date:** [February 9, 2007, 2:54am UTC](https://www.ruby-forum.com/t/attr-protected-and-id/84978/4 "2007-02-09T02:54:40Z")

</div>

Ah, thanks Aaron, that does clear things up, but ‘ouch’, not being  
able to change the id is a little off-putting. Oh well, I guess  
copying it is the way to go.

Dale

---

<div class="post-metadata">

**Author:** ![PeteSalty](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bc79bd/32.png) [@PeteSalty](https://www.ruby-forum.com/u/PeteSalty)\
**Post date:** [February 9, 2007, 12:32am UTC](https://www.ruby-forum.com/t/attr-protected-and-id/84978/5 "2007-02-09T00:32:30Z")

</div>

Your original post asked if you needed to use attr\_protected on id.  
Yes you do, but that would be a pain, so rails did it for you.  
attr\_protected prevents somebody from spoofing a form and messing up  
your database.

> x.id = 3  
> x.save

Take another look at this one. When you did x.save it returned false,  
right? You changed the id of the in-memory version but the save call  
failed and the new id was not written to the database.

I don’t know of any straight-forward way to change an id on a record  
outside of creating a new record and copying all the other values  
over.

Aaron