# Delete data from 2 different models **URL:** \ **Category:** Rails\ **Created:** [May 9, 2008, 8:11pm UTC](https://www.ruby-forum.com/t/delete-data-from-2-different-models/137192 "2008-05-09T20:11:21Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![RoR\_Nb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/2acd7d/32.png) [@RoR\_Nb](https://www.ruby-forum.com/u/RoR_Nb)\ **Post date:** [May 9, 2008, 8:11pm UTC](https://www.ruby-forum.com/t/delete-data-from-2-different-models/137192/1 "2008-05-09T20:11:21Z")
I have this code inside the account controller in the “destroy” method def destroy @account = Account.find(params[:id]) @portal = Portal.find(:all, :conditions =\> [‘account\_id = ?’, @account.id ]) @portal.destroy @account.destroy end any ideas? the error displays this: NoMethodError in AccountsController#destroy undefined method `destroy' for # app/controllers/ accounts_controller.rb:78:in`destroy’ Request Parameters: {"\_method"=\>“delete”, “authenticity\_token”=\>“f8c32ed76159e1b51b0883ef72a4ab801b92d322”, “id”=\>“11”} ---
**Author:** ![RoR\_Nb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/2acd7d/32.png) [@RoR\_Nb](https://www.ruby-forum.com/u/RoR_Nb)\ **Post date:** [May 9, 2008, 8:16pm UTC](https://www.ruby-forum.com/t/delete-data-from-2-different-models/137192/2 "2008-05-09T20:16:41Z")
Try for portal in @portal portal.destroy end Because when you do Portal.find I think you’re getting an array, not a portal? \ ---
**Author:** ![RoR\_Nb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/2acd7d/32.png) [@RoR\_Nb](https://www.ruby-forum.com/u/RoR_Nb)\ **Post date:** [May 10, 2008, 6:34pm UTC](https://www.ruby-forum.com/t/delete-data-from-2-different-models/137192/3 "2008-05-10T18:34:01Z")
Thank you!, Awesome. i was stuck over there, the answere is so simple. I love rails. ---
**Author:** ![RoR\_Nb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/2acd7d/32.png) [@RoR\_Nb](https://www.ruby-forum.com/u/RoR_Nb)\ **Post date:** [May 12, 2008, 10:36am UTC](https://www.ruby-forum.com/t/delete-data-from-2-different-models/137192/4 "2008-05-12T10:36:32Z")
The better way would be to use :dependent =\> :destroy in the model. class Account \<\< ActiveRecord::Base has\_many :portals, :dependent =\> :destroy end and in the controller, def destroy @account = Account.find(params[:id]) @account.destroy end I believe this will work. ---
**Author:** ![RoR\_Nb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/2acd7d/32.png) [@RoR\_Nb](https://www.ruby-forum.com/u/RoR_Nb)\ **Post date:** [May 13, 2008, 7:01am UTC](https://www.ruby-forum.com/t/delete-data-from-2-different-models/137192/5 "2008-05-13T07:01:44Z")
Hey Greg, It’s not a bad idea if you’re passing an id direct into params. I do believe in this format it’s properly sanitized already. It converts it using the “to\_i” function, because it assumes a primary key lookup. “to\_i” will yield to an integer value of 0 when applied to a string. There’s absolutely no problem with passing a param value directly into find using this method of find. If you’re passing it in as a condition, however, then yes, use the question-mark or named-param method which will sanitize it better. Julian. Learn Ruby on Rails! Check out the FREE VIDS (for a limited time) VIDEO #4 parts a and b now available! [http://sensei.zenunit.com/](http://sensei.zenunit.com/) ---
**Author:** ![RoR\_Nb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/2acd7d/32.png) [@RoR\_Nb](https://www.ruby-forum.com/u/RoR_Nb)\ **Post date:** [May 13, 2008, 7:43am UTC](https://www.ruby-forum.com/t/delete-data-from-2-different-models/137192/6 "2008-05-13T07:43:59Z")
On Tue, May 13, 2008 at 12:00 AM, Julian L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > It’s not a bad idea if you’re passing an id direct into params. I do > believe in this format it’s properly sanitized already. I said it’s a bad _habit_ to get into, and it is. The day will come when you will make a custom route with a fairly liberal regular expression that will allow an SQL exploit. It’s best to just never develop the habit of trusting params to begin with. – Greg D. [http://destiney.com/](http://destiney.com/) ---
**Author:** ![RoR\_Nb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/2acd7d/32.png) [@RoR\_Nb](https://www.ruby-forum.com/u/RoR_Nb)\ **Post date:** [May 13, 2008, 8:05am UTC](https://www.ruby-forum.com/t/delete-data-from-2-different-models/137192/7 "2008-05-13T08:05:02Z")
Greg D. wrote: > On Mon, May 12, 2008 at 3:36 AM, Karthi kn > [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > @account = Account.find(params[:id]) > > @account.destroy > > Passing params data directly to find() is a bad habit to get into. > > Account.find( :first, :conditions =\> [‘id = ?’, params[:id] ] > ).destroy rescue nil I may be wrong here, but the primary problem seems to be being able to delete arbitrary accounts (in this case) by passing in the right parameters. You might want to limit the scope of the delete to the current user like this: class ApplicationController \< ActionController::Base def current\_user @current\_user ||= User.find session[:user\_id] if !session[:user\_id].blank? end end And in your controller: current\_user.account.find(params[:id]).destroy ---
**Author:** ![RoR\_Nb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/2acd7d/32.png) [@RoR\_Nb](https://www.ruby-forum.com/u/RoR_Nb)\ **Post date:** [May 13, 2008, 6:20am UTC](https://www.ruby-forum.com/t/delete-data-from-2-different-models/137192/8 "2008-05-13T06:20:45Z")
On Mon, May 12, 2008 at 3:36 AM, Karthi kn [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > @account = Account.find(params[:id]) > @account.destroy Passing params data directly to find() is a bad habit to get into. Account.find( :first, :conditions =\> [‘id = ?’, params[:id] ] ).destroy rescue nil – Greg D. [http://destiney.com/](http://destiney.com/)