title: Passing data that users can't change from form to controller
body: <p>I have this form:</p>
  
  <pre><code>&lt;%= form_for(@book) do |f| %&gt;
      &lt;%= f.text_area 'review' %&gt;
      &lt;%= hidden_field_tag "book[title]", result.title %&gt;
      &lt;%= hidden_field_tag "book[author]", result.author %&gt;
      &lt;%= hidden_field_tag "book[pages]", result.pages %&gt;
      &lt;%= f.submit "Add book" %&gt;
  &lt;% end %&gt;
  </code></pre>
  
  <p>In books_controller I have a <code>create</code> action to add a book.</p>
  
  <p>I don't want the user to be able to change the book's title, author, or pages. The only thing that I want the user's input is the review. </p>
  
  <p>I know that hidden_field_tags are easily tampered with - they can be changed in browsers such as Chrome or Firefox by inspecting the code and changing the value. This would result in the user being able to change the data. </p>
  
  <p>How do I pass data to the <code>create</code> action of the controller without the user being able to change the data?</p>