asp.net mvc: What are the advantages of Model Binding over manual assignments?

Question

Aside from there being less code to write, what are the advantages? Is it more secure?

public JsonResult Update (int id, string name)
{
 Person person = new Person{ 
      ID=id,
      Name=name
 }

 SavePerson(person);
 return Json(...);
}

OR

public JsonResult Update (Person person)
{

SavePerson(person);
return Json(...);

 }

Answer 1

When using the (int id, string name) approach, it is possible these values would end up in the URL string. The other way, it won't. So, that could possibly be considered more secure.

Other than that, if you change the possible properties in your Person class, you wouldn't have to update the values passed in to the (int id, string name) approach. Although, you can get around this by using UpdateMethod(myPersonInstance).

Answer 2

I have to disagree with Nick on the notion of values ending up in the URL string. In fact, there is no difference. Try it! Query string parameters can supply the model values with either method.

Another difference which is possibly significant is that when passing ID and name as arguments, those are the only two fields which can ever be updated. When passing a Person as an argument, potentially other fields could be updated. This may or may not be what you want. But UpdateModel will accept a whitelist of properties you'd like it to update (and similarly for binding a Person instance in an argument), so as long as you remember to consider including a whitelist, there is no real difference here.

To me the biggest difference between the two options you show is who is instantiating the Person instance. When you pass ID and name as arguments, it will always be your controller code which instantiates the Person. When you pass a Person as an argument, it will always be the model binder which instantiates the Person. This could be significant if, rather than instantiating a new Person instance, you would like to materialize an existing instance from a repository.