iHiD

User.create!
# -> #<User id: 2, can_do_dangerous_things: false, ...> 

User.create!(:can_do_dangerous_things => true)
# -> ActiveModel::MassAssignmentSecurity::Error: Can't mass-assign protected attributes: can_do_dangerous_things

User.create!(:permissions => {:can_do_dangerous_things => true})
# -> #<User id: 2, can_do_dangerous_things: true, ...> 

iHiD

config.active_record.whitelist_attributes = true

iHiD

class User < ActiveRecord::Base
  # Has attributes: [:username, :hashed_password, :is_admin]
  attr_accessible :username
end

iHiD

class User < ActiveRecord::Base
  # Has attributes: [:username, :hashed_password, :is_admin]
  attr_accessible :username
  attr_accessible :username, :is_admin, :as => :internal
end

iHiD

User.update_attributes(:username => "iHiD")
User.update_attributes({:username => "iHiD", :is_admin => true}, :as => :internal)

iHiD

class ProjectsController < ApplicationController

  def index
    @projects = Project.where(
      "user_id = #{current_user.id} AND name LIKE '#{params[:name]}%'"
    )
    #...
  end
end

iHiD

SELECT * FROM "projects" 
WHERE user_id = 1 
AND name LIKE '' OR created_at LIKE '%'

iHiD

@projects = Project.where(:user_id => current_user.id).
                    where('name LIKE ?', "#{params[:name]}%")

iHiD

# Use a hash
Project.where(:user_id => current_user.id)

# Use placeholders
Project.where("user_id = ?", current_user.id)

# Use bind variables
Project.where("user_id = :user_id", {:user_id => current_user.id})

iHiD

class ProjectsController < ApplicationController

  def index
    @project = current_user.projects.where('name LIKE ?', "#{params[:name]}%")
    #...
  end
end