gistfile1.rb

class PostsController < ActionController::Base
  def create
    Post.create(post_params)
  end
  
  def update
    Post.find(params[:id]).update_attributes!(post_params)
  end

  private
    def post_params
      params[:post].slice(:title, :content)
    end
end

"Good suggestion from @nk:. Mark params as tainted and have create/update_attributes bark if not untainted via #slice and friends." -dhh