[masklinn]

Except they "give an error" because the provided field doesn't exist in the database. Ignore for a second that half the reposts would break websites if an unexpected parameter yield an error instead of being ignored, if an untrusted client sent an "id" field, that would go through like hot steel through melted butter.

[tomjen3]

Actually Rails have a feature to mark certain parameters as not mass assignable.

[masklinn]

Which is also broken.