search for: header_color1

...the attributes from a passed-in hash as it is used in scaffolding. The attributes are then accessible to mere ordinary mortals and vulnerable to URL/form hackers . So Laszlo devised a cunning plan to make this not so, anymore. The plan results in: update_attributes params[:shop], {:allow => [:header_color1, :header_color:2]} However Marcel whispers quietly beneath his beard that you can use ActiveRecord#attr_protected ( http://api.rubyonrails.com/classes/ActiveRecord/Base.html#M000873) : class Customer < ActiveRecord::Base attr_protected :credit_rating end but alas this is not what Laszlo had...