title: Is there a security risk by letting users choose an associated model via a form?
body: <p>I have a User who has Clients, and Clients have Expenses. I have a form that creates a new expense and on that form the user needs to select which client the expense is for. Here's how I did it:</p>
  
  <pre><code>= form_for(@expense) do |f|
  ...
     = f.select :client_id, options_from_collection_for_select(@possible_clients, "id", "name"), {:include_blank =&gt; true}, :class =&gt; "span10"
  </code></pre>
  
  <p>and the controller:</p>
  
  <pre><code>def create
      @expense = Expense.new(params[:expense])
      @expense.user = current_user
      @expense.date = convert_to_db_date(params[:expense][:date])
  
      respond_to do |format|
        if @expense.save
          format.html { redirect_to expenses_path }
          format.json { render json: @expense, status: :created, location: @expense }
        else
          format.html { render action: "new" }
          format.json { render json: @expense.errors, status: :unprocessable_entity }
        end
      end
    end
  </code></pre>
  
  <p>and the expense model:</p>
  
  <pre><code>  belongs_to :client
    belongs_to :user
    belongs_to :invoice
  
    ## ACCESSIBLE ##
    attr_accessible :amount, :category, :date, :invoice_id, :note, :reimbursed, :user_id, :client_id
  </code></pre>
  
  <p>and the client model:</p>
  
  <pre><code>  belongs_to :user
    has_many :contacts, :dependent =&gt; :destroy
    has_many :invoices
    has_many :expenses
  </code></pre>
  
  <p>So I'm just thinking there's a big security issue here. Since a user can submit any id for the client associated with the expense...they can assign any client, right? Is there a better way of doing this? Is there some rails magic that prevents security issues?</p>