Where is the best place in an app to do validation? Rules of thumb?
Each module should do its own validation and never trust what the calling code gives it. This typically means that validation should happen at each layer of your application. You especially do not want to trust any validation to occurs on the client side, because that can lead to security holes. Code that runs on the client has been known to change from time to time.