Controller.UpdateModel<TModel> Method (TModel, String)
Updates the specified model instance using values from the controller's current value provider and a prefix.
Assembly: System.Web.Mvc (in System.Web.Mvc.dll)
You do not have to explicitly specify the generic parameter TModel. Instead, you can let the C# or Visual Basic type inference engine determine the generic parameter TModel by omitting the generic parameter. The method is like the method except that the method throws an InvalidOperationException exception when the updated model state is not valid.
You should use one of the methods that take either a list of included properties (a white list) or a list of excluded properties (a black list). If no explicit white list or black list is passed, the method tries to update every public property of your model for which there is a corresponding value in the request. A malicious user could exploit this in order to update properties that you do not intend to provide access to.