# Date Integrity and Form Security

**URL:** <https://www.ruby-forum.com/t/date-integrity-and-form-security/90563>\
**Category:** Rails\
**Created:** [March 29, 2007, 10:59pm UTC](https://www.ruby-forum.com/t/date-integrity-and-form-security/90563 "2007-03-29T22:59:05Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 29, 2007, 10:59pm UTC](https://www.ruby-forum.com/t/date-integrity-and-form-security/90563/1 "2007-03-29T22:59:05Z")

</div>

I’m new to rails, and am used to technology that takes care of the  
following issue for you:

When using forms in rails, all your data paths lay exposed to the  
user. It’s easy for them to hack the HTML so that when they POST/GET,  
they set data for columns that you didn’t mean for them to update.  
attr\_protected is a somewhat reasonable solution, but it means that  
you have to be careful about what you do and do not protect. Then you  
have to deal with the columns you decided to protect individually -  
repeatedly! Speaking of wet - ugh.

If that were the only problem, I could probably live with it. But in  
addition to that, you’re also exposing id’s so that you can reference  
specific rows. A mischievous user could modify rows that they should  
not - unless I check every reference to make sure they’re not. Again,  
trouble that I don’t want to deal with.

Has anyone modified or written an alternative to the form helpers that  
would take care of this for me? Seems like all it would take is a big  
hash of magic keys to swap in/out for the normal values. I imagine  
instead of  
\<input … name=“model[attribute]” …  
or even worse  
\<input … name=“model\_rownum\_attribute” …  
you would get  
\<input … name=“my\_magic\_hash” …

Then when the rails app received the next request, the “my\_magic\_hash”  
would be replaced with the the regular string.

I know I’m not the first person to want something like this - has  
anyone done a rails solution?

TIA,  
Kurt