Can't mass-assign protected attributes:

Question

I am trying to submit a form with multiple instances of a class called Boxscore and I keep getting an error saying class "Can't mass-assign protected attributes: 0, 1"

My Form:

  <%= form_for([@boxscore]) do |x| %>
<% 2.times do |i| %>
    <%= fields_for 'boxscores', Boxscore.new, :index => i do |f| %>
      <div class="field">
        <%= f.label :game_id %><br />
        <%= f.number_field :game_id %>
      </div>
      <div class="field">
        <%= f.label :player_id, "Choose a player" %>
        <%= f.select :player_id, Player.all.map{|t| [t.name, t.id]}, 
                 { :include_blank => true } %>
        </div>
      <div class="field">
        <%= f.label :points %><br />
        <%= f.text_field :points %>
      </div>
      <div class="field">
        <%= f.label :rebounds %><br />
        <%= f.text_field :rebounds %>
      </div>
      <div class="field">
        <%= f.label :assists %><br />
        <%= f.text_field :assists %>
      </div>
      <div class="field">
        <%= f.label :blocks %><br />
        <%= f.text_field :blocks %>
      </div>
      <div class="field">
        <%= f.label :steals %><br />
        <%= f.text_field :steals %>
      </div>
      <div class="field">
        <%= f.label :turnovers %><br />
        <%= f.text_field :turnovers %>
      </div>
      <div class="field">
        <%= f.label :fgattempted %><br />
        <%= f.text_field :fgattempted %>
      </div>
      <div class="field">
        <%= f.label :fgmade %><br />
        <%= f.text_field :fgmade %>
      </div>
      <div class="field">
        <%= f.label :threepointattempted %><br />
        <%= f.text_field :threepointattempted %>
      </div>
      <div class="field">
        <%= f.label :threepointmade %><br />
        <%= f.text_field :threepointmade %>
      </div>
    <% end %>
<% end %>       
<div class="actions">
    <%= x.submit %>
</div>
 <% end %>

My model:

 class Boxscore < ActiveRecord::Base
  attr_accessible :boxscore_id, :assists, :blocks, :fgattempted, :fgmade, :game_id, :player_id, :points, :rebounds, :steals, :threepointattempted, :threepointmade, :turnovers

  belongs_to :game
  belongs_to :player
end

My controller:

def create
  @boxscore = Boxscore.new(params[:boxscores])
  respond_to do |format|
    if @boxscore.save
      format.html { redirect_to @boxscore, notice: 'Boxscore was successfully created.' }
      format.json { render json: @boxscore, status: :created, location: @boxscore }
    else
      format.html { render action: "new" }
      format.json { render json: @boxscore.errors, status: :unprocessable_entity }
    end
  end
end

My params hash when creating a boxscore:

{"utf8"=>"✓", "authenticity_token"=>"JJI3di/InpEp4S6HktQWgVfyvk296M7upgQIQRPzJp8=", "boxscores"=>{"0"=>{"game_id"=>"2", "player_id"=>"1", "points"=>"11", "rebounds"=>"22", "assists"=>"11", "blocks"=>"11", "steals"=>"111", "turnovers"=>"22", "fgattempted"=>"3", "fgmade"=>"2", "threepointattempted"=>"11", "threepointmade"=>"22"}, "1"=>{"game_id"=>"2", "player_id"=>"3", "points"=>"3", "rebounds"=>"4", "assists"=>"3", "blocks"=>"55", "steals"=>"4", "turnovers"=>"3", "fgattempted"=>"3", "fgmade"=>"3", "threepointattempted"=>"3", "threepointmade"=>"3"}}, "commit"=>"Create Boxscore", "action"=>"create", "controller"=>"boxscores"}

Answer 1

Now that you've posted the params, it makes the problem a bit clearer.

You can see below that you're posting 2 boxscore records here from your form -- they are identified in the params hash as '0' and '1', which are the two attributes that ActiveRecord is telling you it's having problems with.

The solution is to either do, as Sergio suggests and process them like:

params[:boxscores].each do |k, bs|
  @boxscore = Boxscore.new(bs)
  # ...
end

Or process them individually as two seperate records like this:

  @boxscore1 = Boxscore.new(params[:boxscores][0])
  @boxscore2 = Boxscore.new(params[:boxscores][1])

In general, when you're having weird issues processing form postings, the params hash will help you understand what's happening.

Your params hash in a cleaner, JSON'd format:

{
  "utf8"=>"✓",
  "authenticity_token"=>"JJI3di/InpEp4S6HktQWgVfyvk296M7upgQIQRPzJp8=",
  "boxscores"=>{
    "0"=>{
        "game_id"=>"2",
        "player_id"=>"1",
        "points"=>"11",
        "rebounds"=>"22",
        "assists"=>"11",
        "blocks"=>"11",
        "steals"=>"111",
        "turnovers"=>"22",
        "fgattempted"=>"3",
        "fgmade"=>"2",
        "threepointattempted"=>"11",
        "threepointmade"=>"22"
    },
    "1"=>{
        "game_id"=>"2",
        "player_id"=>"3",
        "points"=>"3",
        "rebounds"=>"4",
        "assists"=>"3",
        "blocks"=>"55",
        "steals"=>"4",
        "turnovers"=>"3",
        "fgattempted"=>"3",
        "fgmade"=>"3",
        "threepointattempted"=>"3",
        "threepointmade"=>"3"
    }
  },
  "commit"=>"Create Boxscore",
  "action"=>"create",
  "controller"=>"boxscores" 
}

Answer 2

@boxscore = Boxscore.new(params[:boxscores])

The problems is here. params[:boxscores] contains two boxscores. And you're trying to create one. Should be something like this:

params[:boxscores].each do |k, bs|
  @boxscore = Boxscore.new(bs)
  # ...
end