Checking what arrives.
WHAT THE FRAMEWORK PROVIDES
A validation system with a large set of rules.
WHERE TO VALIDATE
In a dedicated request class, or at the start of the controller.
WHY THE DEDICATED CLASS
It keeps the controller clean, and it is reusable.
WHAT RULES COVER
Presence Type Length and range Format Uniqueness in the database Matching another field Membership of a permitted set
THAT LAST ONE
The way to safely accept a value that determines behaviour.
WHAT HAPPENS ON FAILURE
The request is rejected, the user is returned to the form, and errors are available to the template.
WHAT TO ENSURE
That the form redisplays what was entered.
WHAT TO CUSTOMISE
Messages, where the defaults are unclear to your users.
WHAT TO VALIDATE BEYOND FORMAT
Business rules: whether the value makes sense in context.
WHAT NOT TO RELY ON
Validation alone for authorisation.
WHAT TO ALSO CHECK
That the user is entitled to act on the record named.
