gistfile1.rb

class PostsController < ActionController::Base
  def create
    Post.create(post_params)
  end
  
  def update
    Post.find(params[:id]).update_attributes!(post_params)
  end

  private
    def post_params
      params[:post].slice(:title, :content)
    end
end

or the inverse...

class PostsController < ActionController::Base
private
  def post_params
    params[:post].except(:created_at)
  end
end

It's better practice to maintain a whitelist w/slice than a blacklist in case new fields are added in the future that you don't want people to have access too.