Data Validation Must Not Contain: 8 Rules

Data validation must not contain any rule that rejects valid data, hides errors, or is applied inconsistently. The core purpose of validation is to catch bad data before it enters a system, so any constraint that blocks good data, masks a problem, or behaves differently depending on context defeats that purpose. Below are the eight specific things a data validation rule must never contain, with explanations and examples.

Formula

The calculator above is a simple illustration: it takes a number of valid records (v) out of a total of 1,000 and returns the percentage that are valid. The formula is:

Percent valid = (v / 1,000) × 100

Where v is the count of records that pass validation, and 1,000 is the total number of records in the sample. The result is expressed as a percentage.

Worked Example

Using the default value of 100 valid records out of 1,000:

1. Divide 100 by 1,000: 100 ÷ 1,000 = 0.1
2. Multiply by 100: 0.1 × 100 = 10

The result is 10%, which matches the calculator output. This simple percentage is useful for measuring how many records pass a validation rule, but the real focus of this article is what a validation rule itself must not contain.

What Data Validation Is

Data validation is the process of checking that data meets predefined rules before it is accepted into a database, form, or application. It can be done on the client side (in a browser or app) or on the server side (in a backend system). Common checks include required fields, data type (number, text, date), length, range, format (email, phone), and uniqueness. The goal is to prevent garbage in, garbage out (GIGO).

Validation rules are typically written in code, in database constraints, or in spreadsheet tools like Excel. They can be simple (e.g., “age must be a positive integer”) or complex (e.g., “shipping date must be at least 2 days after order date”). The key is that the rule must be correct, clear, and consistent.

The 8 Things Data Validation Must Not Contain

Here are the eight specific elements that should never appear in a validation rule:

• 1. Hard-coded values that change – A rule like “price must be less than 100” will break if prices are later raised to 150. Validation should reference a configurable threshold, not a literal number.
• 2. Overly strict formats – Requiring a phone number to match exactly (123) 456-7890 will reject valid numbers written as 123-456-7890 or 123.456.7890. Formats should be flexible or normalized before validation.
• 3. Business logic that belongs elsewhere – Validation should check data integrity, not enforce complex business rules. For example, “discount cannot exceed 50%” is a business rule that may change; it should not be hard-coded in a form field validator.
• 4. Dependencies on other fields without clear order – If field B is only required when field A has a certain value, the rule must explicitly define that dependency. A rule that assumes field A is always filled will fail when it isn’t.
• 5. Ambiguous or contradictory conditions – A rule that says “field must be either empty or greater than 10” is ambiguous: what if the field is 0? The rule should be rewritten as “if field is not empty, it must be greater than 10.”
• 6. Silent fallbacks – A rule that automatically corrects bad data (e.g., changing a negative age to 0) hides the error. Validation should either reject or flag the data, not silently alter it.
• 7. Locale-specific assumptions – Using a comma as a decimal separator in one country and a period in another can cause valid data to be rejected. Validation should use a consistent locale or accept both.
• 8. Time-based conditions that are not timezone-aware – A rule like “date must be today” will fail for users in different time zones. Use UTC or allow a timezone offset.

How to Write a Good Validation Rule

A good validation rule is specific, testable, and maintainable. It should:

• Define the exact data type (string, integer, date, etc.)
• Specify the allowed range or format
• Handle empty values explicitly (is null allowed?)
• Use clear error messages that tell the user what to fix
• Be centralized so it can be updated without changing every form

For example, instead of writing “age must be between 18 and 99” in every form, define a constant MIN_AGE = 18 and MAX_AGE = 99 and reference those. This way, if the age limit changes, you only update one place.

Common Mistakes and Misconceptions

One common mistake is confusing validation with sanitation. Validation rejects bad data; sanitation modifies it to make it safe (e.g., stripping HTML tags). They are different steps and should not be mixed. A validation rule that also sanitizes can hide the original input, making it hard to debug.

Another misconception is that client-side validation is enough. Client-side validation (in JavaScript, for example) is easy to bypass. Server-side validation is mandatory for security and data integrity. Client-side validation is only for user experience.

Also, people often forget to validate data that comes from APIs or databases, assuming it is already clean. That assumption is dangerous. Always validate at the boundary of your system.

How to Choose Validation Rules

When designing validation, start with the data model. What are the fields? What are their types? What are the business requirements? Then, for each field, decide:

• Is it required? (If so, what counts as empty? Empty string, null, whitespace?)
• What is the data type? (Number, text, date, boolean, etc.)
• What is the allowed range or length? (Min/max, max characters)
• Does it need to match a pattern? (Email, phone, zip code)
• Does it need to be unique? (Across what scope?)

Prioritize rules that prevent data corruption over rules that are nice-to-have. For example, a required field is more important than a format check. Also, consider the cost of a false positive (rejecting valid data) vs. a false negative (accepting invalid data). In most cases, false positives are worse because they block users.

Frequently Asked Questions

What is the difference between validation and verification?

Validation checks that data meets the rules (e.g., “is this a valid email?”). Verification checks that data is correct against a source of truth (e.g., “does this email actually exist?”). Validation is about format and range; verification is about authenticity.

Should validation be done on the client or server?

Both. Client-side validation improves user experience by giving instant feedback. Server-side validation is mandatory for security and data integrity. Never rely only on client-side validation.

Can validation rules be too strict?

Yes. Overly strict rules reject valid data and frustrate users. For example, requiring a phone number to be exactly 10 digits will reject numbers with a country code or extension. Use flexible patterns and allow common variations.

How do I handle validation for international data?

Use locale-aware libraries or normalize data to a standard format before validation. For example, convert all dates to ISO 8601 (YYYY-MM-DD) and all numbers to a standard decimal point. This avoids locale-specific issues.

What is the best way to test validation rules?

Write unit tests that cover valid inputs, invalid inputs, boundary values (e.g., exactly at the min/max), and null/empty values. Also test with data that is close to valid but not quite, like a number that is one digit too long.

Can validation rules be changed after data is stored?

Yes, but changing a rule does not retroactively fix existing data. You must either migrate the data or run a separate cleanup process. Always consider backward compatibility when changing validation.

Related

• IUD Insertion Duration & Recovery Timeline
• Creative Uses for Old Mac Computers
• Action RPGs vs Turn-Based RPGs: Which Is Right for You?

in v | Valid value | - | 100 | 0 | 1000
out pct | Percent valid | % | (v / 1000) * 100 | 2