can't insert following_id into database - ruby-on-rails

Question

This is my simple web app for following user, it has an error, please help me :)
I can't insert following_id into database. I'm stuck with it
*This is my application_controller
class ApplicationController < ActionController::Base
protect_from_forgery with: :exception
include WelcomeHelper
end
*WelcomeHelper
module WelcomeHelper
def login(user)
session[:user_id] = user.id
end
def current_user
#current_user ||= User.find(session[:user_id]) if session[:user_id]
end
end
*relation_controller
class RelationController < ApplicationController
def create
follow = User.find(params[:relation][:following_id])
current_user.following << follow
redirect_to current_user
end
*welcome_controller
class WelcomeController < ApplicationController
def index
end
def create
user = User.find_by_username(params[:session][:username])
if user
login user
redirect_to user
else
render 'index'
end
end
def sucess
#users = User.all
#relation = Relation.new
end
end
*relation model
class Relation < ActiveRecord::Base
attr_accessible :follower_id, :following_id
belongs_to :follower, :class_name => "User"
belongs_to :following, :class_name => "User"
end
*usermodel
class User < ActiveRecord::Base
attr_accessible :pass, :username
# Who am I following?
has_many :relations, :foreign_key => :follower_id
has_many :following, :through => :relations
# Who am I followed by?
has_many :relations, :class_name => "Relation", :foreign_key => :following_id
has_many :followers, :through => :relations
validates :username, :pass, :presence => true
validates :username, :pass, :length => { :minimum => 4 }
validates :username, :uniqueness => true
*relations table
class CreateRelations < ActiveRecord::Migration
def change
create_table :relations do |t|
t.references :follower
t.references :following
t.timestamps
end
add_index :relations, :follower_id
add_index :relations, :following_id
end
end
*routes
get "welcome/sucess"
get "welcome/error"
root :to => "welcome#index"
get '/users/:id', :to => 'welcome#sucess', :as => "user"
match '/relations', to: 'relation#create', via: 'post'
resources :users
resources :posts
resources :relations
post 'login' => 'welcome#create'
*sucess view
Following
<ul>
<% current_user.following.each do |u| %>
<li><%= link_to u.username, u %></li>
<% end %>
</ul>
Followed By
<ul>
<% current_user.followers.each do |u| %>
<li><%= link_to u.username, u %></li>
<% end %>
</ul>
List Users<br />
<% if !#users.blank? %>
<% for #user in #users %>
<%= #user.username%><br />
<%= form_for #relation do |f| %>
<%= f.hidden_field :following_id, :value => #user.id %>
<%= f.submit "Follow" %>
<% end %>
<%end%>
<%else%>
<%end%>
when i click "follow" the following_id has been sent:(My current_user id = 9 )
{"utf8"=>"✓",
"authenticity_token"=>"NxOq/F5tOuElvhJNLOvkt/25enUN1wDI05I0fKp998Q=",
"relation"=>{"following_id"=>"11"},
"commit"=>"Follow"}
When i check Relation.all in rails console, the following_id has been insert, but when i check (as curent_user account)user.following - i see nothing, no following_id. I think something wrong in relation_controller at "current_user.following << follow".
I just can follow my current_user but it's ridiculous :)). So, please help me !!!!!!

Answer 1

You need to sanitize parameters before you can put things into the database.
Read more http://guides.rubyonrails.org/security.html