title: Spring MVC 3 - Binding parameters to backing object
body: <p>I am trying to setup an edit form for my <code>User</code> object.  I have automatic binding from the form to the user object working fine.</p>
  
  <p>I'm wondering how do I prevent malicious users from binding to fields of my <code>User</code> object that I don't want them to?</p>
  
  <p>For example, my user object has <code>userName</code>, and it also has <code>points</code>.  When they click edit user, I want them to be able to change the <code>userName</code>, but not the <code>points</code>.  A malicious user could just send an extra <code>points=429429</code> as a hidden field in the form by editing the HTML, and this would automatically be bound to the backing object by Spring.</p>