title: Sanitizing input
body: <p>this may be a really n00b question, but if your list of params contains a bunch of stuff that isn't an attribute accessible, ie</p>
  
  <pre><code>params = {"controller"=&gt;"api1/users", "action"=&gt;"create"}
  </code></pre>
  
  <p>what is the best way to "sanitize" your params so that they only contain the accessible attributes. The current way that I thought of currently is to do :</p>
  
  <pre><code>User._accessible_attributes[:default].entries
  </code></pre>
  
  <p>that gives me a list of accessible attributes and then only pass those params:</p>
  
  <pre><code>["", "email", "password", "fb_token", "fb_id", "fb_name", "first_name", "last_name", "gender"
  </code></pre>
  
  <p>Another possible way is to have this:</p>
  
  <pre><code>  def clean_params #ANTIPATTERN
      params.delete(:controller)
      params.delete(:action)
    end
  </code></pre>
  
  <p>but this also feels like an antipattern...</p>
  
  <p>I know that you're supposed to do something like params[:user] to get only the accessible params, but because this is an API, it would be nice to be able to pass things just in the url.</p>
  
  <p>Thanks!</p>