# How to create when attr\_protected?

**URL:** <https://www.ruby-forum.com/t/how-to-create-when-attr-protected/173631>\
**Category:** Rails\
**Created:** [August 12, 2009, 10:47am UTC](https://www.ruby-forum.com/t/how-to-create-when-attr-protected/173631 "2009-08-12T10:47:59Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![jamal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/35a633/32.png) [@jamal](https://www.ruby-forum.com/u/jamal)\
**Post date:** [August 12, 2009, 10:47am UTC](https://www.ruby-forum.com/t/how-to-create-when-attr-protected/173631/1 "2009-08-12T10:47:59Z")

</div>

Hello,

I’m facing a small issue here with protected columns from being updated.  
(email, username)

So I thought attr\_protected is the solution, but this destroy my  
creation of user?

I cannot assign email when creating new user?

How do I solve this small issue?

---

<div class="post-metadata">

**Author:** ![jamal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/35a633/32.png) [@jamal](https://www.ruby-forum.com/u/jamal)\
**Post date:** [August 12, 2009, 10:57am UTC](https://www.ruby-forum.com/t/how-to-create-when-attr-protected/173631/2 "2009-08-12T10:57:26Z")

</div>

On Aug 12, 9:47 am, Jamal S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> Hello,
> 
> I’m facing a small issue here with protected columns from being updated.  
> (email, username)
> 
> So I thought attr\_protected is the solution, but this destroy my  
> creation of user?

attr\_protected means you cannot assign the attribute using create (or  
update\_attributes etc…)

It does not mean that you can’t do user.email = ‘…’

Fred

---

<div class="post-metadata">

**Author:** ![jamal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/35a633/32.png) [@jamal](https://www.ruby-forum.com/u/jamal)\
**Post date:** [August 12, 2009, 11:02am UTC](https://www.ruby-forum.com/t/how-to-create-when-attr-protected/173631/3 "2009-08-12T11:02:28Z")

</div>

Frederick C. wrote:

> On Aug 12, 9:47�am, Jamal S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> wrote:
> 
> > Hello,
> > 
> > I’m facing a small issue here with protected columns from being updated.  
> > (email, username)
> > 
> > So I thought attr\_protected is the solution, but this destroy my  
> > creation of user?
> 
> attr\_protected means you cannot assign the attribute using create (or  
> update\_attributes etc…)
> 
> It does not mean that you can’t do user.email = ‘…’
> 
> Fred

Thanks for fast answer.

well, that’s a problem then because I need to assign everything myself?

In my controller I did this normally.

For new user

@user = User.new(params[:user])  
@user.save

When updating

@user = session[:user] // when logged in  
@user.update\_attributes(params[:user])

Is this wrong?

When can I use before\_update and before\_create to handle these cases?

I also think update\_attributes goes through all the columns before  
updating to check if any variable has changed :S

---

<div class="post-metadata">

**Author:** ![jamal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/35a633/32.png) [@jamal](https://www.ruby-forum.com/u/jamal)\
**Post date:** [August 12, 2009, 11:43am UTC](https://www.ruby-forum.com/t/how-to-create-when-attr-protected/173631/4 "2009-08-12T11:43:41Z")

</div>

On Aug 12, 10:02 am, Jamal S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> Thanks for fast answer.
> 
> well, that’s a problem then because I need to assign everything myself?

only for those attributes marked as protected.

Fred

---

<div class="post-metadata">

**Author:** ![jamal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/35a633/32.png) [@jamal](https://www.ruby-forum.com/u/jamal)\
**Post date:** [August 12, 2009, 11:07am UTC](https://www.ruby-forum.com/t/how-to-create-when-attr-protected/173631/5 "2009-08-12T11:07:34Z")

</div>

So I must do something like this then for now…

@user = session[:user]  
@user.postal = params[:user][:postal]  
@user.birthday = params[:user][:birthday]  
@user.save

Just to be 100% sure that no one can update anything else 🙂

---

<div class="post-metadata">

**Author:** ![jamal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/35a633/32.png) [@jamal](https://www.ruby-forum.com/u/jamal)\
**Post date:** [August 14, 2009, 12:06am UTC](https://www.ruby-forum.com/t/how-to-create-when-attr-protected/173631/6 "2009-08-14T00:06:24Z")

</div>

Or you could use attr\_readonly method ([http://api.rubyonrails.org/](http://api.rubyonrails.org/)  
classes/ActiveRecord/Base.html#M002282).

On 12 août, 05:07, Jamal S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)