Comment by Spearchucker

My approach has always been to validate anything that crosses a trust boundary. This might be user->app; client->gateway; or app->database.