move sql to controller
use rails form helper and show error messages
complete CRUD on product