random0xff:Yeah on the Model is the best place... if you have a model. What if you have a contact form? Where do you define it, there's no model?
There's still a model. What happens when the user presses the submit button? That should be handled by the model (but "controlled" by the controller
). You'd run your validation from the models too... What I've done is just write a service class, that I named SecurityGuard, to perform my security and validation calls. I named it SecurityGuard because I like to name my classes based on real world jobs.
My SecurityGuard class will let my controller know there was a problem, and that the user should be redirected to an error message. That's how it works right now, but I think attribute based validation and security could be very useful. Hopefully we'll have that option in the future.
Did I answer your question(s)? Phweew...