Mass assignment error with has_and_belongs_to_many

sample_controller.rb

# Option 1
# Explicitly assign it to avoid the mass assignment error.
def create
  user_ids = params[:project].delete(:user_ids)
  @project = Project.new(params[:project])
  @project.user_ids = user_ids
  if @project.save
    flash[:success] = "Project successfully created"
    redirect_to project_overview_url(@project.slug)
  else
    @users = User.all
    render :new
  end
end

# Option 2
# Disable mass assignment protection for this save only.
def create
  @project = Project.new(params[:project], :without_protection => true)
  if @project.save
    flash[:success] = "Project successfully created"
    redirect_to project_overview_url(@project.slug)
  else
    @users = User.all
    render :new
  end
end