Where should form validation occur in a MVC project?

Question

I'm using Kohana, but I think this question is more general.

I have been doing form validation in the controller, and it has worked well so far. But lately, I've ran into a problem.

I have a comments model, and I send comments from a few different controllers to it. Instead of having a validator in every controller, I placed it in the model.

This is great because

• Only one place to change/add validation rules (DRY)

This sucks because

• I obviously need to return a success or failure to the controller, and Kohana's validation library returns errors as an array. So my return looks like this

ON SUCCESS

array('success' => true);

ON FAIL

array('success' => false, $errors);

I can't help but think this is wrong. It feels wrong.

If I do it in the controller, I can simply do

if ($post->validate()) {
     doWhatever();
} else {
     $this->template->formErrors = $post->errors('form_errors');
}

Which seems better (to me).

Is there a better way to do this? Should I validate in the controller or method? Am I going crazy?

Unboned

That's how I do it and then check the success index to decide what to do (not with Kohona, but generally.) – Feucht

Answer 1

I honestly don't see anything wrong with your method, alex. It seems like you're doing it properly. You're following the DRY principle, which for me is usually the yardstick to measure if I'm doing something right when it comes to MVC.

Nidifugous

Answer 2

I don't think all validation rules can go inside the model. Validation is all about the form (or the API). The fact is that when you are validating your data, most of the things depend on the context.

For example, is this a logged-in user taking the action? You wouldn't couple your authentication layer with the model being validated. So, all the checks must go inside the controller. The model is context-agnostic; the form "belongs" to the controller and is context-aware.

I think that having per-form validation rules plus basic in-model checks for well-formed data is the way to go. If you're calling Auth::instance() or Session::instance() inside your model's validate() function, then you're doing it wrong.

Deictic

Answer 3

Fat models. Small controllers. That's the way I always did it. Validation to me is at the data layer. The data layer (to me, at least) is the model. I normally use CakePHP as my MVC framework... Maybe that's why my validation is at the model. It's CakePHP's way.

Grotto

Answer 4

I prefer to not repeat myself over feelings, do the method. Besides the array is handy since you can show the errors from the array in a view if you wanted. I have not used kohana, but the validation method I have been using in ASP.NET MVC provides me with a similar list and I can then show the user what precisely is wrong.

Tedra

Answer 5

You should always (if you can) validate on client (JS). And since that can be bypassed - you validate on server as well. And yes - putting your validation to some reusable form is great idea

Rennie

Unless you troll who just want to move your answer up - give a courtesy of explaining why you are giving -1 to this answer. Validating on client - makes sense it is far more faster then trip back to the server. But relying on client alone is dangerous since it can be easily circumvented. Hence my answer – Rennie

I think you should put more effort into the answer in the first place, not only in the comment. Just for being a judge, I compansated that bastard downvoter. :) – Terrorstricken

Thank you :) Not all of my answers are this short. I was just trying to add my voice to the chorus – Rennie

Answer 6

I do validation in the model too. Most modeling libs like ORM, Auto_Modeler etc. also support validation. BTW it's faster if you ask on the #kohana channel on FreeNode (irc.freenode.net). We (usually) don't bite :)

Youngstown