# Preventing incorrect id params in URLs

**URL:** <https://www.ruby-forum.com/t/preventing-incorrect-id-params-in-urls/225934>\
**Category:** Rails\
**Created:** [December 14, 2006, 11:11pm UTC](https://www.ruby-forum.com/t/preventing-incorrect-id-params-in-urls/225934 "2006-12-14T23:11:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![daborg69](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/d9b06d/32.png) [@daborg69](https://www.ruby-forum.com/u/daborg69)\
**Post date:** [December 14, 2006, 11:11pm UTC](https://www.ruby-forum.com/t/preventing-incorrect-id-params-in-urls/225934/1 "2006-12-14T23:11:12Z")

</div>

Hi,

I’m trying to put together a simple forum.

I have categories and topics.

To create a new topic they click on

/forum/new/1

where "1’ is the id of the category. When they submit the form the I  
have written the following code to create a new topic and a new post…

def create\_new\_topic  
category\_id = params[:id]  
@forum\_topic = ForumTopic.new(params[:forum\_topic])  
@forum\_topic.category\_id = category\_id  
@message = @forum\_topic.forum\_post.build(params[:forum\_post])  
@forum\_topic.user\_id = session[:user\_id]  
if @forum\_topic.save  
update\_post(@message.id, @forum\_topic.id)  
flash[:notice] = ‘ForumTopic was successfully created.’  
redirect\_to :action =\> ‘list’  
else  
render :action =\> ‘new’  
end  
end

# The following method updates the post, after the topic has been

created. It assigns the correct topic id to the post  
def update\_post(post\_id, topic\_id)  
post = post\_id  
topic= topic\_id  
@post = ForumPost.find(post)  
user = session[:user\_id]  
@post.update\_attribute(:user\_id, user)  
@post.update\_attribute(:topic\_id, topic)  
@post.save  
end

My problem is… If i enter any id in the /forum/new/1 URL, my code will  
create a new topic even if it doesn’t correspond to any of the  
categories.

I have tried this sort of thing, but I just can’t get it to work…

def new  
permitted\_categories = ForumCategories.find(:all)  
category = params[:id]  
if category == permitted\_categories  
@forum\_topic = ForumTopic.new  
@forum\_post = ForumPost.new  
else  
flash[:notice] = ‘Category not found’  
redirect\_to :action =\> ‘index’  
end

Any ideas?

---

<div class="post-metadata">

**Author:** ![daborg69](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/d9b06d/32.png) [@daborg69](https://www.ruby-forum.com/u/daborg69)\
**Post date:** [December 14, 2006, 11:33pm UTC](https://www.ruby-forum.com/t/preventing-incorrect-id-params-in-urls/225934/2 "2006-12-14T23:33:19Z")

</div>

Do some error handling like such:

begin  
category = Category.find(params[:id])  
rescue ActiveRecord::RecordNotFound  
logger.error(“Attempt to access invalid catalog #{params[:id]}” )  
flash[:notice] = “Invalid catalog”  
redirect\_to :action =\> :index  
else  
…what you want to happen when there is a catalog  
end

Hope that helps --K

---

<div class="post-metadata">

**Author:** ![daborg69](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/d9b06d/32.png) [@daborg69](https://www.ruby-forum.com/u/daborg69)\
**Post date:** [December 14, 2006, 11:55pm UTC](https://www.ruby-forum.com/t/preventing-incorrect-id-params-in-urls/225934/3 "2006-12-14T23:55:38Z")

</div>

Kim wrote:

> Do some error handling like such:
> 
> begin  
> category = Category.find(params[:id])  
> rescue ActiveRecord::RecordNotFound  
> logger.error(“Attempt to access invalid catalog #{params[:id]}” )  
> flash[:notice] = “Invalid catalog”  
> redirect\_to :action =\> :index  
> else  
> …what you want to happen when there is a catalog  
> end
> 
> Hope that helps --K

That’s works! Thanks so much

However, I don’t quite understand how. Why do you create the variable  
category at the start? How is that used?

thanks

---

<div class="post-metadata">

**Author:** ![daborg69](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/d9b06d/32.png) [@daborg69](https://www.ruby-forum.com/u/daborg69)\
**Post date:** [December 15, 2006, 7:16am UTC](https://www.ruby-forum.com/t/preventing-incorrect-id-params-in-urls/225934/4 "2006-12-15T07:16:10Z")

</div>

On Dec 14, 4:55 pm, Scott H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> > ```
> > ...what you want to happen when there is a catalog
> > 
> > ```
> 
> Posted viahttp://www.ruby-forum.com/.  
> You can think of creating it in case you find it…

Jason

---

<div class="post-metadata">

**Author:** ![daborg69](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/d9b06d/32.png) [@daborg69](https://www.ruby-forum.com/u/daborg69)\
**Post date:** [December 15, 2006, 7:43pm UTC](https://www.ruby-forum.com/t/preventing-incorrect-id-params-in-urls/225934/5 "2006-12-15T19:43:46Z")

</div>

begin / rescue is the ruby way to handle/prevent potential errors.

When you say ‘begin’ the system tries to do whatever is next. In this  
case it tries to find the catalog entry with the passed in id. If it  
can not, then it does what is in the ‘rescue’ block. Else, if it can  
find the catalog, it skips over the rescue code and does what is in the  
else block. You can then use the catalog variable in the else statement  
to do whatever you want the system to do.

Hope that explains it - K