Kennedy Article on Rails Secuity

build_params.php

<?php

  // ...
  protected function build_params() {
    $whitelist = array("name", "surname");

    $params = array();
    foreach($_POST as $key => $value) {
      if (in_array($key, $whitelist)) {
        $params[":$key"] = $value;
      }
    }
    return $params;
  }
  // ...
?>

FYI, a bit more terse: https://gist.github.com/2140151