【发布时间】:2011-12-16 08:56:22
【问题描述】:
new.html.erb
<h3>Add post</h3>
<%= form_tag :controller=>'posts', :action=>'create' do %>
<%= label :q, :Title %>
<%= text_field :data, :title, :class => :addtextsize %><br/>
<%= label :q, :Content %>
<%= text_area :data, :content, :rows=>10 , :class => :addtextarea %><br/>
<%= label :q, :Category %>
<%= select :data, :category_id, @categories_select %><br/>
<%= label :q, :Tags %>
<%= text_field :data, :tags, :class => :addtextsize %><br/>
<%= label :q, :Submit %>
<%= submit_tag "Add Post" %>
<% end %>
创建 PostController.rb 的动作
def create
@categories_select = Category.all.collect {|c| [ c.category_name, c.id ] }
@addpost = Post.new params[:data]
if @addpost.save
flash[:notice] = "Post has been saved successfully."
redirect_to posts_path
else
flash[:notice] = "Post can not be saved, please enter information."
render :new
#redirect_to new_post_path
end
end
获取 users.id 我需要将其插入到帖子表中。我该怎么做?
帖子表
Table "public.posts"
Column | Type | Modifiers
-------------+------------------------+----------------------------------------------------
id | integer | not null default nextval('posts_id_seq'::regclass)
title | character varying(100) | not null
content | character varying(500) | not null
created_at | date |
updated_at | date |
tags | character varying(55) | not null default '50'::character varying
category_id | integer | not null default 1
user_id | integer |
Indexes:
"posts_pkey" PRIMARY KEY, btree (id)
【问题讨论】:
-
您是否尝试过在您的帖子中使用 user.id 添加隐藏字段?
-
添加隐藏字段是个好主意吗?使用隐藏字段不是易受攻击吗?
-
Rails 提供了您需要的所有安全性,尽管我看不出在隐藏字段中插入用户 ID 的危险(它不是用户名或任何明智的东西吗?)在您看来,您也可以按照@Banster74 所说的第二个选项。
-
我想建议您通过在类别视图中使用例如 collection_select 来稍微重构您的控制器代码。 api.rubyonrails.org/classes/ActionView/Helpers/…
标签: ruby-on-rails ruby ruby-on-rails-3 ruby-on-rails-3.1 devise