Passing parameters from form to controller using RoR

Question

I am new to RoR development and am a little confused about how parameters are passed from a HTML view to the controller. I have seen a few examples online which use a private method like this:

private
def message_params
  params.require(:message).permit(:content)
end

I have been looking for some clarification online as to what this method does and how it works, but I only encounter posts/articles which use the method rather than explain what it does.

I was hoping someone could explain how the method takes(/filters?) values passed via the form via a POST request, what the require and permit keywords mean and how would i change this method to fit my own use.

For example if i needed to get data about a new book would i do this:

private
    def book_params
      params.require(:book_name).require(:ISBN).require(:Author).permit(:Illustrator)
    end

Would the above be valid given that my book object has those fields?

Any clarification would be appreciated.

Thank you.

Answer 1

This kind of function is used to whitelist params - ie say you have a message model, and through the controller actions you should only be able to change the content. Maybe there is also an author field - but even if someone were to pass that through the form, you would not want to update it.

params.require(:message)

Will return to you params[:message]. permit means you are allowing only the content field through.

See: http://edgeguides.rubyonrails.org/action_controller_overview.html#strong-parameters

I would need to see your model setup, but I would assume given a book model you'd want something more akin to:

params.require(:book).permit(:illustrator, :author, :isbn)

Answer 2

here is some info (I'm using your sample model Book and BookController), that probably can help you more understand

when you submit form, rails automatically called create method, inside create method you will see Book.new(book_params), book_params will call private method and will check which field allowed, if there is another field that submitted but not listed inside your permit block then it will be not passed along to save command

class BooksController < ApplicationController

  def create
    @book = Book.new(book_params)
    if @book.save
      flash[:success] = 'Data save successfully'
      redirect_to books_path
    else
      render :new
    end    
  end

private

  def book_params
    params.require(:book).permit(
      :book_name,
      :isbn,
      :author,
      :illustrator)
  end

end