Data validation strategies are often heavily influenced by the architecture for the application. If the application is already in production it will be significantly harder to build the optimal architecture than if the application is still in a design stage. If a system takes a typical architectural approach of providing common services then one common component can filter all input and output thus optimizing the rules and minimizing efforts.

There are three main models to think about when designing a data validation strategy.

*Accept Only Known Valid Data

*Reject Known Bad Data

*Sanitize Bad Data

We cannot emphasize strongly enough that Accept Only Known Valid Data is the best strategy. We do however recognize that this isn't always feasible for political financial or technical reasons and so we describe the other strategies as well.

All three methods must check:

*Data Type

*Syntax

*Length