need_id and user_id should come form the params via routes (at the top level, not nested under params[:contribution]) or from `current_user`. Putting them here implies they come from the form, but you don't want those things to be user input.