# Submit\_tag? **URL:** \ **Category:** Rails\ **Created:** [March 15, 2007, 5:58pm UTC](https://www.ruby-forum.com/t/submit-tag/88928 "2007-03-15T17:58:58Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [March 15, 2007, 5:58pm UTC](https://www.ruby-forum.com/t/submit-tag/88928/1 "2007-03-15T17:58:58Z")
I have a protected attribute that I wish to change with my edit form. Is it possible to do this with the “options” for submit\_tag? I guess what I’m asking is if there is a way to have the submit perform the, in this case, user.admin=user[admin] assignment I would like to occur when the form is submitted? ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [March 15, 2007, 8:24pm UTC](https://www.ruby-forum.com/t/submit-tag/88928/2 "2007-03-15T20:24:42Z")
removed\_email\_address@domain.invalid wrote: > I have a protected attribute that I wish to change with my edit form. > Is it possible to do this with the “options” for submit\_tag? > > I guess what I’m asking is if there is a way to have the submit > perform the, in this case, user.admin=user[admin] assignment I would > like to occur when the form is submitted? I think if the attribute is protected, you would have to do a manual assignment. Nelson * * * Basedex - A Collaborative Index to organize and collect everything related to Ruby on Rails [http://blazingrails.basedex.com/index/8](http://blazingrails.basedex.com/index/8) ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [March 15, 2007, 8:35pm UTC](https://www.ruby-forum.com/t/submit-tag/88928/3 "2007-03-15T20:35:22Z")
Thanks for the response. That is what I was fearing. I was hoping someone knew of a way to tie the assignment to the submission of the edit form so that it happened at the same time/transparently. On Mar 15, 1:24 pm, Nelson H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [March 15, 2007, 8:39pm UTC](https://www.ruby-forum.com/t/submit-tag/88928/4 "2007-03-15T20:39:13Z")
removed\_email\_address@domain.invalid wrote: > Thanks for the response. That is what I was fearing. I was hoping > someone knew of a way to tie the assignment to the submission of the > edit form so that it happened at the same time/transparently. > > On Mar 15, 1:24 pm, Nelson H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) How are you protecting your attribute? Are you using Ruby’s access control (i.e. public, protected, private), are you using ActiveRecord’s attr\_protected macro? Nelson * * * Basedex - A Collaborative Index to organize and collect everything related to Ruby on Rails [http://blazingrails.basedex.com/index/8](http://blazingrails.basedex.com/index/8) ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [March 15, 2007, 8:51pm UTC](https://www.ruby-forum.com/t/submit-tag/88928/5 "2007-03-15T20:51:25Z")
I’m using the attr\_protected macro. On Mar 15, 1:39 pm, Nelson H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [March 15, 2007, 9:14pm UTC](https://www.ruby-forum.com/t/submit-tag/88928/6 "2007-03-15T21:14:29Z")
removed\_email\_address@domain.invalid wrote: > I’m using the attr\_protected macro. > > On Mar 15, 1:39 pm, Nelson H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) From the documentation: Attributes named in this macro are protected from mass-assignment, such as new(attributes) and attributes=(attributes). Their assignment will simply be ignored. Instead, you can use the direct writer methods to do assignment. This is meant to protect sensitive attributes from being overwritten by URL/form hackers. So basically, attr\_protected was designed specifically to prevent what you want to do. 🙂 Nelson ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [March 22, 2007, 11:57pm UTC](https://www.ruby-forum.com/t/submit-tag/88928/7 "2007-03-22T23:57:43Z")
removed\_email\_address@domain.invalid wrote: > Yeah, I was hoping there was a way to embed or trigger a direct > assignment from the data provided in the form when they do a submit. > > In the documentation there is a reference to “options” for submit\_to > but it doesn’t elaborate in any way. I was hoping maybe there was a > way to pass a direct assignment as an “option” or something similar. > > Oh well. Thanks though 🙂 > > On Mar 15, 2:14 pm, Nelson H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [March 15, 2007, 9:26pm UTC](https://www.ruby-forum.com/t/submit-tag/88928/8 "2007-03-15T21:26:32Z")
Yeah, I was hoping there was a way to embed or trigger a direct assignment from the data provided in the form when they do a submit. In the documentation there is a reference to “options” for submit\_to but it doesn’t elaborate in any way. I was hoping maybe there was a way to pass a direct assignment as an “option” or something similar. Oh well. Thanks though 🙂 On Mar 15, 2:14 pm, Nelson H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)