Creating a whitelist is a good way to prevent “mass assignment” attacks per @amirrajan at the Austin .NET Users group tonight!