Controller.UpdateModel<TModel> Method (TModel, String)
Updates the specified model instance using values from the controller's current value provider and a prefix.
Assembly: System.Web.Mvc (in System.Web.Mvc.dll)
You do not have to explicitly specify the generic parameter TModel. Instead, you can let the C# or Visual Basic type inference engine determine the generic parameter TModel by omitting it.
Use one of the TryUpdateModel methods that takes either a list of properties to include (a whitelist) or a list of properties to exclude (a blacklist). If no explicit whitelist or blacklist is passed, the TryUpdateModel method tries to update every public property in the model for which there is a corresponding value in the request. A malicious user could exploit this in order to update properties that you do not intend to provide access to.