I find that having the data model visible in the model files helps remind me which attributes the model has, but future code listings will omit the annotations for brevity. (Note that, if you want your annotati ons to be up-to-date, you’ll have to run annotate again any time the data model changes.)

      Accessible Attributes

Let’s revisit the User model, focusing now on the attr_accessible line (Listing 6.6). This line tells Rails which attributes of the model are accessible, that is, which attributes can be modified automatically by outside users (such as users submitting requests with web browsers).

Listing 6.6 Making the name and email attributes accessible.
app/models/user.rb

______________________________________________________
              class  User  < ActiveRecord::Base
                       attr accessible  :name, :email
            end

________________________________________________________

The code in Listing 6.6 doesn’t do quite what you might think. By default, all model attributes are accessible. What Listing 6.6 does is to ensure that the name and email attributes—and only the name and email attributes—are automatically accessible to outside users. We’ll see why this is important in Chapter 9: using attr_accessible is important for preventing a mass assignment vulnerability, a distressingly common and often serious security hole in many Rails applications.