# How to protect attributes from being updated? **URL:** \ **Category:** Rails\ **Created:** [January 27, 2007, 2:35am UTC](https://www.ruby-forum.com/t/how-to-protect-attributes-from-being-updated/83561 "2007-01-27T02:35:38Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![gmarik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/ecccb3/32.png) [@gmarik](https://www.ruby-forum.com/u/gmarik)\ **Post date:** [January 27, 2007, 2:35am UTC](https://www.ruby-forum.com/t/how-to-protect-attributes-from-being-updated/83561/1 "2007-01-27T02:35:38Z")
Hi! I’m new to Rails! Rails rox! 1 quesion so far: I have :email attribute in User model. I dont’ want :email to allow to be updated. How do i do this with Rails? Do I have to implement required validation manually? Thanks! ---
**Author:** ![gmarik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/ecccb3/32.png) [@gmarik](https://www.ruby-forum.com/u/gmarik)\ **Post date:** [January 27, 2007, 3:55am UTC](https://www.ruby-forum.com/t/how-to-protect-attributes-from-being-updated/83561/2 "2007-01-27T03:55:45Z")
On 1/26/07, gmarik [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Do I have to implement required validation manually? > > Thanks! > > > classs User \< ActiveRecord::Base attr\_protected :email … end Docs: [http://caboo.se/doc/classes/ActiveRecord/Base.html#M006884](http://caboo.se/doc/classes/ActiveRecord/Base.html#M006884) – Zack C. [http://depixelate.com](http://depixelate.com) ---
**Author:** ![gmarik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/ecccb3/32.png) [@gmarik](https://www.ruby-forum.com/u/gmarik)\ **Post date:** [January 29, 2007, 1:55pm UTC](https://www.ruby-forum.com/t/how-to-protect-attributes-from-being-updated/83561/3 "2007-01-29T13:55:56Z")
Thanks Zak, but it’s not what i need. I don’t want it to be UPDATED(ie Edit) And i need this attribute, when object is being CREATED(ie New). So it could look like this(the code isnt’ valid): … attr\_accessible :name, :description attr\_accessible :email if new\_record? … Any ideas? Thanks! ---
**Author:** ![gmarik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/ecccb3/32.png) [@gmarik](https://www.ruby-forum.com/u/gmarik)\ **Post date:** [January 29, 2007, 2:47pm UTC](https://www.ruby-forum.com/t/how-to-protect-attributes-from-being-updated/83561/4 "2007-01-29T14:47:18Z")
I’d say you should do something like… attr\_accessor :address attr\_protected :email def before\_create self.email = address end and use User#address in the form. RSL ---
**Author:** ![gmarik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/ecccb3/32.png) [@gmarik](https://www.ruby-forum.com/u/gmarik)\ **Post date:** [January 30, 2007, 11:31am UTC](https://www.ruby-forum.com/t/how-to-protect-attributes-from-being-updated/83561/5 "2007-01-30T11:31:44Z")
Nice trick! Thanks Russell! ---
**Author:** ![gmarik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/ecccb3/32.png) [@gmarik](https://www.ruby-forum.com/u/gmarik)\ **Post date:** [January 30, 2007, 6:38pm UTC](https://www.ruby-forum.com/t/how-to-protect-attributes-from-being-updated/83561/6 "2007-01-30T18:38:27Z")
On 1/29/07, gmarik [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Thanks Zak, but it’s not what i need. > I don’t want it to be UPDATED(ie Edit) > And i need this attribute, when object is being CREATED(ie New). > > So it could look like this(the code isnt’ valid): > … > attr\_accessible :name, :description > attr\_accessible :email if new\_record? > … attr\_readonly – see [http://dev.rubyonrails.org/ticket/6896](http://dev.rubyonrails.org/ticket/6896) – may be what you’re looking for? I’m not overly optimistic about our chances of getting it added, though… Another option for emulating read only attributes could be a before\_save callback that; locks the row (select for update), then load the model into some variable and then copy the field in question into self. I’m not sure Russel’s approach will work; say you load the model, the row/column is changed by some other process, and then you save your old model again overwriting the new value. I’d just go with attr\_protected and set that field individually on creation, if this is all you need. Isak ---
**Author:** ![gmarik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/ecccb3/32.png) [@gmarik](https://www.ruby-forum.com/u/gmarik)\ **Post date:** [January 31, 2007, 2:06pm UTC](https://www.ruby-forum.com/t/how-to-protect-attributes-from-being-updated/83561/7 "2007-01-31T14:06:15Z")
Well, for now Russel’s approach is just fine. The issue with other processes modifying attribute directly can be avoided by putting attr\_reader for :email, so it’ won’t be changed from outside. Right? Thanks! ---
**Author:** ![gmarik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/ecccb3/32.png) [@gmarik](https://www.ruby-forum.com/u/gmarik)\ **Post date:** [January 31, 2007, 7:55pm UTC](https://www.ruby-forum.com/t/how-to-protect-attributes-from-being-updated/83561/8 "2007-01-31T19:55:55Z")
On 1/31/07, gmarik [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Well, for now Russel’s approach is just fine. > > The issue with other processes modifying attribute directly can be > avoided by putting attr\_reader for :email, so it’ won’t be changed > from outside. Right? If your app is the only thing writing to that particular field, protecting the attribute in your model - either with attr\_protected, an overridden mutator, or the dummy attribute idea - is probably enough, yea. Isak