I'm wondering, if i have a model where all values can be set through a form, do i still need to use attr\_accessible ?

The important thing that comes to my mind is the id field (or maybe even the created\_at, updated\_at) fields.

Should i always whitelist the accessible fields if there is a form around ?