# app/models/user.rb
class User < ActiveRecord::Base
  attr_accessible :username, :password
end

# app/controllers/users_controller.rb
class UsersController < ApplicationController
  def create
    @user = User.create! params[:user]
    redirect_to @user
  end
end

# app/models/user.rb
class User < ActiveRecord::Base
end

# app/controllers/users_controller.rb
class UsersController < ApplicationController
  def create
    @user = User.create! user_params
    redirect_to @user
  end

  private
  def user_params
    params.require(:user).permit(:username, :password)
  end
end

require(key): 从 hash 中提取相应的 key，如果没有触发 ActionController::ParameterMissing 错误。
permit(keys): 设置被允许的属性，并把 permitted 属性设置为 true。