# Filter params with strong parameters

**URL:** <https://discuss.rubyonrails.org/t/filter-params-with-strong-parameters/66531>\
**Category:** rubyonrails-talk\
**Created:** [March 8, 2013, 9:27am UTC](https://discuss.rubyonrails.org/t/filter-params-with-strong-parameters/66531 "2013-03-08T09:27:50Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Linus\_Marton](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/linus_marton/32/4063_2.png) [@Linus\_Marton](https://discuss.rubyonrails.org/u/Linus_Marton)\
**Post date:** [March 8, 2013, 9:27am UTC](https://discuss.rubyonrails.org/t/filter-params-with-strong-parameters/66531/1 "2013-03-08T09:27:50Z")

</div>

Hi

I have an hstore field in my database where I store a lot of different fields.

I still want getters, setters and validations for my fields so I’ve created an array with the fields like this:

DOCUMENT\_FIELDS = %w[foo bar baz]

Then I do some meta programming to create getters and setters:

DOCUMENT\_FIELDS.each do |field|

define\_method(field) do

# …

end

define\_method(“#{field}=”) do |value|

# …

end

end

Now I would like to pass all fields to strong parameters to properly filter it. I tried like this:

params.require(:foo).permit(Foo::DOCUMENT\_FIELDS.map(&:to\_sym))

But this doesn’t work. It removes all values anyway. I guess it is because `Foo::DOCUMENT_FIELDS.map(&:to_sym)` creates an array that is passed to strong parameters (and it seems to not work with arrays).

How can I get around this?

Cheers,

Linus

---

<div class="post-metadata">

**Author:** ![Jordon\_Bedwell](https://avatars.discourse-cdn.com/v4/letter/j/e480ec/32.png) [@Jordon\_Bedwell](https://discuss.rubyonrails.org/u/Jordon_Bedwell)\
**Post date:** [March 8, 2013, 9:35am UTC](https://discuss.rubyonrails.org/t/filter-params-with-strong-parameters/66531/2 "2013-03-08T09:35:13Z")

</div>

`params.require(:foo).permit(*Foo::DOCUMENT_FIELDS.map(&:to_sym))` Though if I'm honest I probably would expect you to not take the long trip with map and to\_sym, might as well just leave them as string keys because params has indifferent access with default keys being all string keys for security.

---

<div class="post-metadata">

**Author:** ![Jordon\_Bedwell](https://avatars.discourse-cdn.com/v4/letter/j/e480ec/32.png) [@Jordon\_Bedwell](https://discuss.rubyonrails.org/u/Jordon_Bedwell)\
**Post date:** [March 8, 2013, 9:36am UTC](https://discuss.rubyonrails.org/t/filter-params-with-strong-parameters/66531/3 "2013-03-08T09:36:42Z")

</div>

I forgot to say what \* does. It will expand the array into args.

---

<div class="post-metadata">

**Author:** ![Linus\_Marton](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/linus_marton/32/4063_2.png) [@Linus\_Marton](https://discuss.rubyonrails.org/u/Linus_Marton)\
**Post date:** [March 8, 2013, 9:37am UTC](https://discuss.rubyonrails.org/t/filter-params-with-strong-parameters/66531/4 "2013-03-08T09:37:06Z")

</div>

Got it myself! Splat operator to the rescue 🙂

params.require(:foo).permit(\*Foo::DOCUMENT\_FIELDS.map(&:to\_sym))

---

<div class="post-metadata">

**Author:** ![Linus\_Marton](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/linus_marton/32/4063_2.png) [@Linus\_Marton](https://discuss.rubyonrails.org/u/Linus_Marton)\
**Post date:** [March 8, 2013, 9:41am UTC](https://discuss.rubyonrails.org/t/filter-params-with-strong-parameters/66531/5 "2013-03-08T09:41:15Z")

</div>

Thank you. I thought strong params needed symbols.

Cheers,

Linus