title: Rails: How to create a new entry in the join table
body: <p>Let's consider a practical example: A product that has many reviews, written by clients. We have a many-to-many relationship between <em>product</em> and <em>client</em> through <em>reviews</em>.</p>
  
  <pre><code>class Product &lt; ActiveRecord::Base
      has_many :reviews
      has_many :clients, :through =&gt; :reviews
  end
  
  class Client &lt; ActiveRecord::Base
      has_many :reviews
      has_many :products, :through =&gt; :reviews
  end
  
  class Reviews &lt; ActiveRecord::Base
      belongs_to :product
      belongs_to :client
  end
  </code></pre>
  
  <p>Here, I'm using the <code>has_many :through</code> to create the many-to-many relation, because the <em>review</em> table needs to have extra attributes, like the score, content, likes,...</p>
  
  <p>The user logs into my app, so I can get his data through:</p>
  
  <pre><code>client = Client.find_by_id current_user.id
  </code></pre>
  
  <p>He goes to the product page, so I can get product data:</p>
  
  <pre><code>product = Product.find_by_id params[:id]
  </code></pre>
  
  <p><strong>How can I create client review of the product?</strong></p>
  
  <p>I tried:</p>
  
  <pre><code>review = Review.create :client =&gt; client, :product =&gt; product, :comment =&gt; params[:review][:comment]
  </code></pre>
  
  <p>but it gives me: <em>MassAssignSecurity: can't mass-assign protected attributes: product, client</em></p>
  
  <p>Any idea? Thanks in advance.</p>