Question

If I have a 3 layer web forms application that takes user input, I know I can validate that input using validation controls in the presentation layer. Should I also validate in the business and data layers as well to protect against SQL injection and also issues? What validations should go in each layer?

Another example would be passing a ID to return a record. Should the data layer ensure that the id is valid or should that happen in BLL / UI?

Answer 1

You should validate in all layers of your application.

What validation will occur at each layer is specific to the layer itself. Each layer should be safe to send “bad” requests to and get a meaningful response, but which checks to perform at each layer will depend on your specific requirements.

Broadly:

• User Interface – Should validate user input, provide helpful error messages and visual clues to correcting them; it should be protecting your lower layers against invalid user input.
• Business / Domain Layer – Should check arguments to methods are valid (throwing ArgumentException and similar when they are not) and should check that operations are possible within the constraints of your business rules; it should be protecting your domain against programming mistakes.
• Data Layer – Should check the data you are trying to insert or update is valid within the context of your database, that it meets all the relational constraints and check constraints; it should be protecting your database against mistakes in data-access.

Validation at each layer will ensure that only data and operations the layer believes to be correct are allowed to enter. This gives you a great deal of predictability, knowing information had to meet certain criteria to make it through to your database, that operations had to be logical to make it through your domain layer, and that user input has been sanitized and is easier to work with.

It also gives you security knowing that if any of your layers was subverted, there is another layer performing checks behind it which should prevent anything entering which you don’t want to.