# "must be nil" validation?

**URL:** <https://www.ruby-forum.com/t/must-be-nil-validation/184892>\
**Category:** Rails\
**Created:** [March 10, 2010, 4:35am UTC](https://www.ruby-forum.com/t/must-be-nil-validation/184892 "2010-03-10T04:35:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Seirie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/b5ac83/32.png) [@Seirie](https://www.ruby-forum.com/u/Seirie)\
**Post date:** [March 10, 2010, 4:35am UTC](https://www.ruby-forum.com/t/must-be-nil-validation/184892/1 "2010-03-10T04:35:01Z")

</div>

Hey guys, is there a validation that essentially acts the opposite way  
of “validates\_presence\_of”. That is, the attribute in question must be  
nil, or blank, non-existent. If not, what’s the best way to prevent a  
user from altering a web form attempting to submit data to a field  
that they should never have access to?

Thanks!

---

<div class="post-metadata">

**Author:** ![Seirie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/b5ac83/32.png) [@Seirie](https://www.ruby-forum.com/u/Seirie)\
**Post date:** [March 10, 2010, 5:21am UTC](https://www.ruby-forum.com/t/must-be-nil-validation/184892/2 "2010-03-10T05:21:34Z")

</div>

Seirie wrote:

> Hey guys, is there a validation that essentially acts the opposite way  
> of “validates\_presence\_of”. That is, the attribute in question must be  
> nil, or blank, non-existent. If not, what’s the best way to prevent a  
> user from altering a web form attempting to submit data to a field  
> that they should never have access to?

What you’re looking for is attr\_accessible and/or attr\_protected:

[http://railsapi.com/doc/rails-v2.3.5/classes/ActiveRecord/Base.html#M000920](http://railsapi.com/doc/rails-v2.3.5/classes/ActiveRecord/Base.html#M000920)

If you were to do that in validation it would render the attribute  
virtually useless. You would have to bypass validation altogether in  
order to set it at all. What you really want is to disallow mass  
assignment of the attribute. That’s what the above methods do.

---

<div class="post-metadata">

**Author:** ![Seirie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/b5ac83/32.png) [@Seirie](https://www.ruby-forum.com/u/Seirie)\
**Post date:** [March 10, 2010, 5:34am UTC](https://www.ruby-forum.com/t/must-be-nil-validation/184892/3 "2010-03-10T05:34:09Z")

</div>

brilliant, exactly what I was looking for. Thank you much Robert.