Question

I have my form

<% form_tag users_path, :id => 'registrationForm' do %>
  <div class="formElement">
    <label for="emailAddress">Email Address</label>
    <input name="user[email]" type="text">
  </div>
  <div class="formElement">
    <label for="password">Password</label>
    <input id="password" name="user[password]" type="password">
  </div>
  <div class="formElement">
    <label for="passwordConfirmation">Re-Enter Password</label>
    <input id="passwordConfirmation" name="user[password_confirmation]" type="password">
  </div>

  <div class="formElement right">
    <input name="commit" value="Create" type="submit">
  </div>
<% end %>

and then my controller method to process this which contains

@user = User.new(params[:user])
@user.save do |result|
  ...
end

This works fine. However, if I add ‘first_name’ and ‘last_name’ fields to my database table and add

<div class="formElement">
  <label for="firstName">First Name</label>
  <input id="firstName" name="user[first_name]" type="text" />
</div>
<div class="formElement">
  <label for="lastName">Last Name</label>
  <input id="lastName" name="user[last_name]" type="text" />
</div>

to my form, I get

Mysql::Error: Column ‘last_name’
cannot be null: INSERT INTO users
(salt, ship_address_id,
created_at, single_access_token,
last_request_at, bill_address_id,
crypted_password,
remember_token_expires_at,
updated_at, perishable_token,
api_key, failed_login_count,
current_login_ip,
openid_identifier,
current_login_at, last_name,
remember_token, persistence_token,
login_count, last_login_ip,
last_login_at, login, email,
first_name)
VALUES(‘gPa4FNsPHbfxLz1FTZJ8’, NULL,
‘2010-11-03 18:07:24’,
‘INl0QTDduoCKSdLLXEqb’, ‘2010-11-03
18:07:24’, NULL,
‘900d7300768651e4814ca16b1dd39b85e8111c92a63d366c82e3f1d501dc7b85efc060bc2032e55e4405fe33b0883b0ad586fe47e99261b046a34a8b9d785333’,
NULL, ‘2010-11-03 18:07:24’,
‘r8YSPUfKsmbIIJryvz5C’, NULL, 0,
‘127.0.0.1’, NULL, ‘2010-11-03
18:07:24’, NULL, NULL,
‘d4fe33e9c1bde5e2468d74d3dc1de28089f565d7e0d39584690452547be6d3bbf529e9ac118575529f34e377cce315697538c64b19f799e386d6977a8f37912e’,
1, NULL, NULL, ‘[e-mail]’,
‘[e-mail]’, NULL)

Here’s the parameters the error page says were passed:

{“commit”=>”Create”,
“authenticity_token”=>”tFpn+DGMU3VfeaSrc5ckVoVCxfy76Xm0Mqf8Jx8JEFs=”,
“user”=>{“password_confirmation”=>”test”,
“last_name”=>”User3”,
“password”=>”test”,
“first_name”=>”Test3”,
“email”=>”[e-mail]”}}

Any ideas why I get this MySQL error?

Answer 1

Are you using attr_accessible or attr_protected in your User model to guard against mass-assignment exploits?