# Is there a better way to update fields in an web app?

This is the stripped down version of my update action for a Posts (blog post) controller:

Posts.update = function(req, res){
_.extend(req.post, {
title: req.body.title
,   author: req.body.author
,   body: req.body.body
});
post.save();
};


This way feels a bit clumsy and repetitive, because I have similar code in another method, but I don't want to just straight up _.extend(req.post, req.body) because it may allow someone to change fields that shouldn't be changed in my models.

Is there a better middle ground?

How about _.pick()?
Posts.update = function(req, res){