# Attr\_reader not being read?

**URL:** <https://www.ruby-forum.com/t/attr-reader-not-being-read/48963>\
**Category:** Rails\
**Created:** [November 27, 2005, 9:30pm UTC](https://www.ruby-forum.com/t/attr-reader-not-being-read/48963 "2005-11-27T21:30:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ol1barn3s](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/9de053/32.png) [@ol1barn3s](https://www.ruby-forum.com/u/ol1barn3s)\
**Post date:** [November 27, 2005, 9:30pm UTC](https://www.ruby-forum.com/t/attr-reader-not-being-read/48963/1 "2005-11-27T21:30:59Z")

</div>

I have this model that holds search parameters accross pages:

class Search \< User  
attr\_reader :min\_age, :max\_age  
end

for a form:  
…  
\<% age\_list = (0…99).collect {|x| [x,(Date.today.year-x)]} %\>  
\<%= select ‘search’,‘min\_age’, age\_list %\>  
  
\<%= select ‘search’,‘max\_age’, age\_list.reverse %\>  
  
  
…

then in the search controller I have:

class SearchController \< ApplicationController

def simple  
if params[:search]  
@search = Search.new(params[:search])  
session[:search] = @search  
else  
@search = session[:search]  
end

```
    @results = User.find(:all,
			    :conditions => [":min_age < year(birthday) < :max_age",

```

{:min\_age =\> min\_age, :max\_age =\> max\_age}])  
…  
end

for some reason I’m getting

"NoMethodError in Search#simple

undefined method `min\_age=’ for #Search:0x23da2cc"

as if min\_age weren’t defined… what could be causing this?

thanks  
Oliver

---

<div class="post-metadata">

**Author:** ![ol1barn3s](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/9de053/32.png) [@ol1barn3s](https://www.ruby-forum.com/u/ol1barn3s)\
**Post date:** [November 28, 2005, 5:55pm UTC](https://www.ruby-forum.com/t/attr-reader-not-being-read/48963/2 "2005-11-28T17:55:16Z")

</div>

Oliver,

I think you’re okay up to the point where you do

> {:min\_age =\> min\_age, :max\_age =\> max\_age}])

Because you’re doing assignments, :min\_age and :max\_age need to be  
writable. attr\_reader does not generate an assignment method of the  
form described in the NoMethodError message. If you’ll look closely  
at the method name referenced there, you’ll see the “=” appended to  
“min\_age”.

Long story short – change your “attr\_reader” declaration to use  
“attr\_writer” and your code should work as you expect.

Regards,  
David

---

<div class="post-metadata">

**Author:** ![ol1barn3s](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/9de053/32.png) [@ol1barn3s](https://www.ruby-forum.com/u/ol1barn3s)\
**Post date:** [November 28, 2005, 9:05pm UTC](https://www.ruby-forum.com/t/attr-reader-not-being-read/48963/3 "2005-11-28T21:05:28Z")

</div>

David, many thanks for the thorough explanation. using attr\_accessor  
did the trick, and I understand better how these attribute setters  
work.

I’ve read up on the article you sent, and am now using  
‘attr\_accessible’ for the attributes being searched for, from what I  
understood this would be the most secure way correct?

2005/11/28, David R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

---

<div class="post-metadata">

**Author:** ![ol1barn3s](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/9de053/32.png) [@ol1barn3s](https://www.ruby-forum.com/u/ol1barn3s)\
**Post date:** [November 28, 2005, 7:28pm UTC](https://www.ruby-forum.com/t/attr-reader-not-being-read/48963/4 "2005-11-28T19:28:22Z")

</div>

Oliver,

After further review, I wanted to correct and clarify a couple of  
things. The problem is related to the the writability of your  
attributes, but it’s not in the line I cited. That line is just  
setting the values of the parameters used in the SQL query that does  
your find(). It’s when you call Search.new(params[:search]) that  
you’re getting the complaint about the undefined method. This form of  
new() is a shortcut for assigning values to all attributes that have  
corresponding parameters in the inbound request. You can still change  
the declaration of your attributes, but you probably want to change  
them (in the simplest case) to “attr\_accessor”, instead of  
“attr\_reader” or “attr\_writer”. attr\_accessor generates both read and  
write methods. If you change them to attr\_writer, you’ll be able to  
write to the attributes but not read from them (the converse of the  
problem you’re having now).

Keep in mind that there are some implications for the security of  
your data when you use the shortcut method for assigning attributes  
from request parameters. [Peak Obsession](http://manuals.rubyonrails.com/export/html/8)  
has some good information on this topic.

David

---

<div class="post-metadata">

**Author:** ![ol1barn3s](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/9de053/32.png) [@ol1barn3s](https://www.ruby-forum.com/u/ol1barn3s)\
**Post date:** [November 28, 2005, 10:22pm UTC](https://www.ruby-forum.com/t/attr-reader-not-being-read/48963/5 "2005-11-28T22:22:16Z")

</div>

It’s more secure, in the sense that it gives you explicit control  
over which attributes can be set automatically from forms. Any  
attributes declared as attr\_accessible are still subject to the same  
kinds of attacks described in that article. If your app needs more  
security, you’ll need to take even more control and set attributes by  
calling the setter methods directly (say, after you do your own  
validation), rather than letting them be set automatically by the  
new / initialize methods.

Glad I could help. 🙂