Design advice needed. Data validation

[Vladas Razas]

Hi,
I have standard J2EE project: web interface and EJB business model. Data from user input has to be validated. Where shall I put validation code: servlets/JSP or in business model? What is standard practice? Maybe there is some kind of pattern or best practice for this.
Thanks and regads,
Vladas

[Ben Dover]

Hi Vladas,
you have a few options here.
1. If youre using a business delegate you can incorporate validation within that tier.
2. Use servlet filters as decorators to validate your data before it leaves the web tier.
3. Validate in EJB tier with session beans. This can cause unnecessary overhead if your EJB tier is remote.
4. Use Struts. It has good inherent data validation support.
5. Place validation code within the value objects.
6. Validate in Entity EJB. This is not recommended, as Enity EJB should not be used for business logic. And your value object may not map directly to the EJB.
Personally I would go for a design with clean separation of responsibilities, and use validation helper classes in the web tier, which is closer to where you are presenting and modyfying the data objects. For simple flow of logic, use a servlet filter to validate your javabeans before calling BD or EJB's. For more complex requirements go with Struts, it is a higher learning curve but is powerful.
Whichever you choose, your validator helper classes should be portable enough to be called from any tier within your app. The patterns you should consider for implementing validation helpers are Factory and Strategy.

[sarah Marsh]

How about use Javascript to do the validation first. Anybody can show me a piece of code that Javascript is embedded in JSP for validation usage? Thanks!

[Ben Dover]

Javascript is not a good idea for data validation in a web application. The developer has no control over a user's browser settings.

[Stan James]

I always say the model cannot shirk responsibility for assuring the data is valid. It cannot assume that it will always use a reliable client that can be trusted to give it good data. Clients are allowed to duplicate data validation to whatever extent they can bear the pain of duplicate code. A really cool implementation puts the validation rules in a rules engine that can generate Javascript or interpret the rules on real data, so all tiers can use exactly the same rules.
One Struts group in my company uses a guideline of checking for required fields in JavaScript, checking for data types in the servlet-container tier, validation and cross checking in the EJB tier. Would that work for you?

[Vladas Razas]

[Kishore Dandu]

If it is a intranet project, some times the users will be given only one option of type of browser that is supported(IE or Netscape etc).
In that case you can go with JavaScript for initial mandatory fields to be filled. For the type checking it is better to do on the rules engine on server side.
Dan

[Brian R. Wainwright]

Hello,
You'll often see, hear, or read people say that data validation shoudl be done as close to the client as possible - in a web application this immediately leads to JavaScript. The idea being that you want to save the user as many trips to the server as possible - so it may work for you to do basic validation of data. But JavaScript sucks for the the complex business and data validation that often accompanies a web application. That said, there's often two kinds of validation - business validation (is what's being done the right thing to do at that moment and does the data being manipulated fit with my use case?) and data validation (is this a valid date, username, etc... according to my business rules?). Personally, I like the idea of using STRUTS - its validation mechanism is VERY robust. Others have posted similarly good ideas before me, so I won't reiterate. In short... I wouldn't really consider JavaScript as a means fo doing the validation you probably want to do. Besides - the internet is pretty fast nowadays. Either write your own utility classes for doing so or make use of an existing framework like STRUTS. Use JavaScript only if you have to.
Luck.
--BW
[ February 26, 2004: Message edited by: Brian R. Wainwright ]