title: Passing ID Value to a Controller, Getting Mass Assignment Security Error
body: <p>I have a message model and a user model. my message <code>belongs_to</code> my user and user <code>has_many</code> messages. </p>
  
  <p>I'm trying to allow a user to private message another user while on their public profile page (their show template). I have tried a number of attempts, but I ultimately run back into the issue of requiring an ID to be <code>attr_accessible</code> (which I heard is bad to do). Am I doing something wrong?</p>
  
  <p>My message model, I have <code>:user_id</code> (which is the current user, aka a <code>sending_from</code> ID), <code>:to_id</code>, <code>:content</code>.</p>
  
  <p>When I'm looking at a users profile page, on the show template I have</p>
  
  <pre><code>    &lt;%= form_for([current_user, @message])  do |f| %&gt;
          &lt;%= f.hidden_field :to_id, :value =&gt; @user.id %&gt;
          &lt;div class="field"&gt;
            &lt;%= f.text_area :content, placeholder: "Send a private message..." %&gt;
          &lt;/div&gt;
          &lt;%= f.submit "Post", class: "btn btn-large btn-primary" %&gt;
      &lt;% end %&gt;
  </code></pre>
  
  <p>In my user show action, I have</p>
  
  <pre><code>def show
     @user = User.find(params[:id])
     @microposts = @user.microposts.paginate(page: params[:page])
     if user_signed_in?
        @message = current_user.messages.build(params[:messages], to_id: @user.id)
     end
  end
  </code></pre>
  
  <p>when the form submits, it goes to my message create action</p>
  
  <pre><code>def create
      @message = current_user.messages.build(params[:message])
      redirect_to user_path(params[:message][:to_id])
  end
  </code></pre>
  
  <p>However, I always get the error</p>
  
  <pre><code>`Can't mass-assign protected attributes: to_id`
  </code></pre>
  
  <p>It seems like I can fix it by making <code>:to_id attr_accessible</code>, however I have heard it is not very safe to do so. Am I doing something wrong? This issue has been killing me. </p>
  
  <p>Any help would be appreciated. Thanks</p>