# Update\_attributes workaround needed? **URL:** \ **Category:** Rails\ **Created:** [April 19, 2007, 11:18pm UTC](https://www.ruby-forum.com/t/update-attributes-workaround-needed/92486 "2007-04-19T23:18:09Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![ehudros](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/3ec8ea/32.png) [@ehudros](https://www.ruby-forum.com/u/ehudros)\ **Post date:** [April 19, 2007, 11:18pm UTC](https://www.ruby-forum.com/t/update-attributes-workaround-needed/92486/1 "2007-04-19T23:18:09Z")
Hi everyone, I’m doing white list validations on the controller side so that malformed data would not get to the database. However, this seems to be tricky when updating an entity since I can’t find a way to seperate the attribute updating from the saving itself. What i’m looking for is a way to either run white\_list on the parameters in the params array (I don’t know if accessing a specific param is even possible) or running it on the entity itself before it is saved. currently the code is as follows: @post = Post.find(params[:id]) if @post.update\_attributes(params[:post]) … end I cant seem to access the input received from the form independently (like params[:body] if I had a body text field in the form), and since update\_attributes updates the attributes and also saves the data I’m stuck… Any ideas? Thanks, Ehud ---
**Author:** ![ehudros](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/3ec8ea/32.png) [@ehudros](https://www.ruby-forum.com/u/ehudros)\ **Post date:** [April 20, 2007, 1:50am UTC](https://www.ruby-forum.com/t/update-attributes-workaround-needed/92486/2 "2007-04-20T01:50:46Z")
To access the “body” field, you would do the following: params[:post][:body] ---
**Author:** ![ehudros](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/3ec8ea/32.png) [@ehudros](https://www.ruby-forum.com/u/ehudros)\ **Post date:** [April 20, 2007, 6:24am UTC](https://www.ruby-forum.com/t/update-attributes-workaround-needed/92486/3 "2007-04-20T06:24:34Z")
On 4/19/07, Dylan M. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > To access the “body” field, you would do the following: > > params[:post][:body] You can also do @post.attributes = params[:post]. It updates the attributes without saving them to the database. – Rick O. [http://lighthouseapp.com](http://lighthouseapp.com) [http://weblog.techno-weenie.net](http://weblog.techno-weenie.net) [http://mephistoblog.com](http://mephistoblog.com) ---
**Author:** ![ehudros](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/3ec8ea/32.png) [@ehudros](https://www.ruby-forum.com/u/ehudros)\ **Post date:** [April 21, 2007, 4:33pm UTC](https://www.ruby-forum.com/t/update-attributes-workaround-needed/92486/4 "2007-04-21T16:33:04Z")
Piotr W. wrote: > Ehud R. wrote: > > > Any ideas? > > In Rails, input validation should be done in model, not in controller. > > Then you will be given false or exception when trying to save invalid > object. You will also be able to use model’s valid? method. hmm… that sounds reasonable. How can I hook to the save method and run white list on the relevant columns before they are inserted to the database? ---
**Author:** ![ehudros](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/3ec8ea/32.png) [@ehudros](https://www.ruby-forum.com/u/ehudros)\ **Post date:** [April 20, 2007, 10:13am UTC](https://www.ruby-forum.com/t/update-attributes-workaround-needed/92486/5 "2007-04-20T10:13:53Z")
Ehud R. wrote: > Any ideas? In Rails, input validation should be done in model, not in controller. Then you will be given false or exception when trying to save invalid object. You will also be able to use model’s valid? method. ---
**Author:** ![ehudros](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/3ec8ea/32.png) [@ehudros](https://www.ruby-forum.com/u/ehudros)\ **Post date:** [April 21, 2007, 9:02pm UTC](https://www.ruby-forum.com/t/update-attributes-workaround-needed/92486/6 "2007-04-21T21:02:38Z")
Ehud R. wrote: > > In Rails, input validation should be done in model, not in controller. > > > > Then you will be given false or exception when trying to save invalid > > object. You will also be able to use model’s valid? method. > > hmm… that sounds reasonable. How can I hook to the save method and run > white list on the relevant columns before they are inserted to the > database? Use Rails Validations. ---
**Author:** ![ehudros](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/3ec8ea/32.png) [@ehudros](https://www.ruby-forum.com/u/ehudros)\ **Post date:** [April 21, 2007, 11:37pm UTC](https://www.ruby-forum.com/t/update-attributes-workaround-needed/92486/7 "2007-04-21T23:37:52Z")
Ehud R. wrote: > > Use Rails Validations. > > I’m not sure validations are what I’m looking for… > I want to mannipulate the data saved, not run a test on it whether it > caontains forbidden strings. It would probably work as the validate > method run for each save, but would not be very pretty imo. > > Is there another way to hook into the save mechanism of a model? found it myself - before\_validation is what im looking for ---
**Author:** ![ehudros](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/3ec8ea/32.png) [@ehudros](https://www.ruby-forum.com/u/ehudros)\ **Post date:** [April 21, 2007, 10:23pm UTC](https://www.ruby-forum.com/t/update-attributes-workaround-needed/92486/8 "2007-04-21T22:23:20Z")
> Use Rails Validations. I’m not sure validations are what I’m looking for… I want to mannipulate the data saved, not run a test on it whether it caontains forbidden strings. It would probably work as the validate method run for each save, but would not be very pretty imo. Is there another way to hook into the save mechanism of a model?