# To protect or not email attribute of user

**URL:** <https://www.ruby-forum.com/t/to-protect-or-not-email-attribute-of-user/176215>\
**Category:** Rails\
**Created:** [September 26, 2009, 9:01pm UTC](https://www.ruby-forum.com/t/to-protect-or-not-email-attribute-of-user/176215 "2009-09-26T21:01:14Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![fipa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/9e8a1a/32.png) [@fipa](https://www.ruby-forum.com/u/fipa)\
**Post date:** [September 26, 2009, 9:01pm UTC](https://www.ruby-forum.com/t/to-protect-or-not-email-attribute-of-user/176215/1 "2009-09-26T21:01:14Z")

</div>

Hi,

What’s your best practice about the email attribute of a registered user  
in your DB. I don’t want people to be able to change email.

But what’s best?

1. protect the email attribute with attr\_protected or attr\_accessible  
and suffer the pain of having to do user.email = … everywhere in your  
code and tests

2. Keep email accessible, but write a custom update\_attributes that  
filters the email attribute?