- First of all you need to understand the architecture of web applications, most if not all are 3-tier:
b) Business Logic - PHP/RoR/Java where the data from the client is collected, processed and store and where client requests for data are processed and sent back to the client
c) Backend Data Store - provides persistent storage for the system information
- So where do you do the validation, in all layers. Why?
a) Client side - ensure the user enters correct data, required fields etc
c) Backend Data Store - constraints ensure that the data is well formed for storage and later retrieval.
So where do you focus your validation efforts, use each layer to perform the validation that suits it best, and leave more complex rules for the layer that can handle it