I struggle to find examples that work within VB.net (forced into it at my job) since 90% of them are presented in C# (since probably 90% of all mvc development is in c# :) ).  Today I struggled for a few minutes to come up with the correct syntax for restricting the properties to bind when passing a model to an action.  Here’s a code example:

   1: <AcceptVerbs(HttpVerbs.Post)> _

   2: Function Create(<Bind(Include:="Username,Email,City,State,Zipcode")> ByVal user As User) As ActionResult

   3:  

   4: End Function

Why would you want to do this?  For security reasons… a smart user could tamper with the post data and update other fields you didn’t intend to update.  See here.