Question

Say you have a web form with some fields that you want to validate to be only some subset of alphanumeric, a minimum or maximum length etc.

You can validate in the client with javascript, you can post the data back to the server and report back to the user, either via ajax or not. You could have the validation rules in the database and push back error messages to the user that way.

Or any combination of all of the above.

If you want a single place to keep validation rules for web application user data that persist to a database, what are some best practices, patterns or general good advice for doing so?

[edit]

I have edited the question title to better reflect my actual question! Some great answers so far btw.

Answer 1

all of the above:

1. client-side validation is more convenient for the user
2. but you can’t trust the client so the code-behind should also validate
3. similarly the database can’t trust that you validated so validate there too

EDIT: i see that you’ve edited the question to ask for a single point of specification for validation rules. This is called a ‘Data Dictionary’ (DD), and is a Good Thing to have and use to generate validation rules in the different layers. Most systems don’t, however, so don’t feel bad if you never get around to building such a thing 😉

One possible/simple design for a DD for a modern 3-tier system might just include – along with the usual max-size/min-size/datatype info – a Javascript expression/function field, C# assembly/class/method field(s), and a sql expression field. The javascript could be slotted into the client-side validation, the C# info could be used for a reflection load/call for server-side validation, and the sql expression could be used for database validation.

But while this is all good in theory, I don’t know of any real-world systems that actually do this in practice [though it ‘sounds’ like a Good Idea].

If you do, let us know how it goes!