# Validation on methods that aren't part of the database

**URL:** <https://www.ruby-forum.com/t/validation-on-methods-that-arent-part-of-the-database/65191>\
**Category:** Rails\
**Created:** [August 16, 2006, 7:03pm UTC](https://www.ruby-forum.com/t/validation-on-methods-that-arent-part-of-the-database/65191 "2006-08-16T19:03:22Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![jjkiesch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bc79bd/32.png) [@jjkiesch](https://www.ruby-forum.com/u/jjkiesch)\
**Post date:** [August 16, 2006, 7:03pm UTC](https://www.ruby-forum.com/t/validation-on-methods-that-arent-part-of-the-database/65191/1 "2006-08-16T19:03:22Z")

</div>

using the Rails Recipes book, i went through the tutorial on setting up  
authentication on a site. the tutorial was great, but it raises a few  
questions.

the fields in the database are password\_hash, and password\_salt. the  
tutorial creates another method for password that takes the value it was  
given and hashes it and adds the 6 character salt at the end.

what if i want to perform validation on the password that is entered  
when a user signs up? first, i want to make sure that the user entered  
one in the first place, second, that it is a certain number of  
characters. i tried adding validation to the model but i’m guessing it  
didn’t work because there isn’t an actual field in the database called  
password.

are there any workarounds for something like this? is there a way to use  
the validation helpers on things that aren’t in a database?

---

<div class="post-metadata">

**Author:** ![jjkiesch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bc79bd/32.png) [@jjkiesch](https://www.ruby-forum.com/u/jjkiesch)\
**Post date:** [August 16, 2006, 10:55pm UTC](https://www.ruby-forum.com/t/validation-on-methods-that-arent-part-of-the-database/65191/2 "2006-08-16T22:55:02Z")

</div>

you should be able to create a method like so;

def check\_password( password )  
if password.length == 0  
\< whatever else you want \>  
end

then in the controller, call  
user.check\_password( params[:password] )

if it returns true… continue with the salting and off you go.

That should work… but I could be wrong. I’m tired today.

Josh K. wrote:

> when a user signs up? first, i want to make sure that the user entered
> 
> * * *
> 
> Rails mailing list  
> removed\_email\_address@domain.invalid  
> [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails)

–  
View this message in context:  
[http://www.nabble.com/validation-on-methods--that-aren't-part-of-the-database.-tf2116574.html#a5840399](http://www.nabble.com/validation-on-methods--that-aren%27t-part-of-the-database.-tf2116574.html#a5840399)  
Sent from the RubyOnRails Users forum at [Nabble.com](http://Nabble.com).

---

<div class="post-metadata">

**Author:** ![jjkiesch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bc79bd/32.png) [@jjkiesch](https://www.ruby-forum.com/u/jjkiesch)\
**Post date:** [August 16, 2006, 11:07pm UTC](https://www.ruby-forum.com/t/validation-on-methods-that-arent-part-of-the-database/65191/3 "2006-08-16T23:07:16Z")

</div>

yeah something like that would work. i’m just not familiar enough with  
the rails framework to know if there’s an easier way to do it using the  
active record validation helpers.

for now, i’ll just use this approach though. thanks.

sw0rdfish wrote:

> you should be able to create a method like so;
> 
> def check\_password( password )  
> if password.length == 0  
> \< whatever else you want \>  
> end
> 
> then in the controller, call  
> user.check\_password( params[:password] )
> 
> if it returns true… continue with the salting and off you go.
> 
> That should work… but I could be wrong. I’m tired today.

---

<div class="post-metadata">

**Author:** ![jjkiesch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bc79bd/32.png) [@jjkiesch](https://www.ruby-forum.com/u/jjkiesch)\
**Post date:** [August 16, 2006, 11:19pm UTC](https://www.ruby-forum.com/t/validation-on-methods-that-arent-part-of-the-database/65191/4 "2006-08-16T23:19:03Z")

</div>

you can write some code in a method called validate in the the model,  
and  
it’ll run that code before it validates your model… in which case you  
can  
call errors.add to add errors…

I’ve not done much with it, but I know it’s something to that effect.

Josh K. wrote:

> > def check\_password( password )
> 
> –  
> Posted via [http://www.ruby-forum.com/](http://www.ruby-forum.com/).
> 
> * * *
> 
> Rails mailing list  
> removed\_email\_address@domain.invalid  
> [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails)

–  
View this message in context:  
[http://www.nabble.com/validation-on-methods--that-aren't-part-of-the-database.-tf2116574.html#a5840875](http://www.nabble.com/validation-on-methods--that-aren%27t-part-of-the-database.-tf2116574.html#a5840875)  
Sent from the RubyOnRails Users forum at [Nabble.com](http://Nabble.com).

---

<div class="post-metadata">

**Author:** ![jjkiesch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bc79bd/32.png) [@jjkiesch](https://www.ruby-forum.com/u/jjkiesch)\
**Post date:** [August 16, 2006, 11:24pm UTC](https://www.ruby-forum.com/t/validation-on-methods-that-arent-part-of-the-database/65191/5 "2006-08-16T23:24:33Z")

</div>

so in theory, i can check the password the same way i would in your  
example but if it’s in the validate method, it will check automatically  
before the record is saved? if that’s the way it works, that would be  
perfect.

sw0rdfish wrote:

> you can write some code in a method called validate in the the model,  
> and  
> it’ll run that code before it validates your model… in which case you  
> can  
> call errors.add to add errors…
> 
> I’ve not done much with it, but I know it’s something to that effect.

---

<div class="post-metadata">

**Author:** ![jjkiesch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bc79bd/32.png) [@jjkiesch](https://www.ruby-forum.com/u/jjkiesch)\
**Post date:** [August 16, 2006, 11:55pm UTC](https://www.ruby-forum.com/t/validation-on-methods-that-arent-part-of-the-database/65191/6 "2006-08-16T23:55:34Z")

</div>

I got something to work:

def validate  
unless self.password && self.password.length \> 0  
errors.add(‘Password’, ‘is invalid’)  
end  
end

def password=(pass)  
salt = [Array.new(6) { rand(256).chr }.join].pack(‘m’).chomp  
self.password\_salt, self.password\_hash = salt,  
Digest::SHA256.hexdigest(pass + salt)  
@password = pass  
end

def password  
@password  
end

I would like to hear from anyone on doing things this way, just to see  
if this is something that would be secure.