## M
class User < ActiveRecord::Base
  validates_confirmation_of :password, :on => :create

  attr_accessor :password, :password_confirmation

  def password=(pass)
    salt = User.random_string(8)
    update_attributes(:password_salt => salt, :password_hash => Digest::SHA256.hexdigest(pass + salt))
  end
end

## V
<% form_for @user do |f| %>
	<p>
		<%= f.label :password %>
		<%= f.password_field :password %>
	</p>

	<p>
		<%= f.label :password_confirmation %>
		<%= f.password_field :password_confirmation %>
	</p>

	<p>
		<%= f.submit 'Create' %>
	</p>
<% end %>

## C
class UsersController < ApplicationController
  def create
    @user = User.new(params[:user])
    if @user.save
      flash[:notice] = 'User was successfully created.'
      redirect_to :action => :index
    else
      render :action => 'new'
    end
  end
end