rails 4 form_tag usage

Question

I'm using rails 4.0.2 framework. I've a picture scaffolding and from the show page of 'picture' I'm struggling to add a simple builtin form to forward this to an email address.
After entering an email and clicking on the 'forward' button it should send a current picture link in an email. But I'm struggling to achieve this. I created a controller 'forward_picture' with action 'create' and added it as a resource in config/routes file. Then I created a form within picture view as follows.

views/pictures/show.html.erb

...   
<%= form_tag(:controller => "forward_picture", :action => "create") do %>  
  <%= hidden_field_tag :picture_id, params[:@picture.id] %>  
  <%= label_tag :email %>  
  <%= text_field_tag :email, params[:email] %>  
  <%= submit_tag "Forward" %>    
<% end %>  

Is this the correct way to embed a form, pass parameters and call appropriate action (create) in the forward_picture_controller? How do I use access the parameters in the controller given strong parameter policy in rails 4? In the controller I can construct an appropriate URL to send the given email address.

Any help is appreciated.

Answer 1

It's usually good practice to create routes and give them names. In your routes.rb file:

post :forward_picture, to: "forward_picture#create", as: :forward_picture

The last attribute, defined here:

as: :forward_picture

Will create a 'name' for your route, and consequently create a name_path method that can be callable from any view. Your form could then use it like this:

<%= form_tag forward_picture_path do %>

As for the parameters, you should be able to get by params[:email] or params[:picture_id]. Strong parameters are only used on mass assignment, i.e. product.create(params[:product]) where params could have several attributes for the Product model. That's when yo want to sanitize the params[:product] hash to make sure you're only allowing in what you need. This is when you use safe params.