Question

I don’t know if the term “mass assignment” is Rails-specific but I get the basic idea that mass assignment is when you assign values to a bunch of variables all in the same method.

Is that a correct definition and why is there a special name for this?

Answer 1

Mass assignment in Rails is when you use something like User.new(:name => "David", :occupation => "Code Artist") to set all of the values for a row at once. The danger comes in when you change this code to be more like User.new(params[:user]). Now it’s possible for an end user to maliciously craft the Hash that is passed in as a parameter to User.new and set variables you weren’t expecting. Hence the need for attr_accessible and attr_protected, which limit an end user’s ability to set fields that they shouldn’t be able to affect directly.