Rails form protection questions, hidden field

Question

I have a live rails website and I want to have a form with a lot of fields on it. I have set up validations and allowed formatting for every field. I've tested it quite a bit and it seems to catch anything I throw at it. I think it's almost ready to go live, but I want to quadruple check if there's anything else I should do to protect it. My site has a low volume of visitors, but I want it to be a safe as possible. I'd like to avoid using a captcha if I can. I've read that you can use a hidden field to protect forms against bots. Do people recommend this instead of using a captcha, or even using it with a captcha?

my form is really standard:

<% form_for(@entry) do |f| %>
  ...
  <%= f.submit 'Create' %>
<% end %>

Any suggestions or code samples would be greatly appreciated.

gtd · Accepted Answer · 2010-04-02 20:23:22Z

2

You should whitelist a list of attributes that the user is allowed to edit in your model using attr_accessible

answered Apr 2, 2010 at 20:23

gtd

17.4k6 gold badges52 silver badges65 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Eimantas · Accepted Answer · 2010-04-02 20:23:03Z

0

Write tests/specs for your models/controllers/views?

answered Apr 2, 2010 at 20:23

Eimantas

49.5k17 gold badges135 silver badges173 bronze badges

Collectives™ on Stack Overflow

Rails form protection questions, hidden field

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related