[UK-AL]

Field level validation(Is this email in a valid format) checking that input is sane is done at the UI level.

Business rule validation(E.g student can't be assigned more than 10 courses) is done on the entities themselves.

You put it on both sides to get the best of both. Instant feedback to the user, and on entities as last resort protection against a badly implemented interface.

[dozzie]

> Field level validation(Is this email in a valid format) checking that input is sane is done at the UI level.

In two places in UI: as close to the user as possible (which improves ergonomics) and at the system's border (which prevents entering invalid data to the system at all). While the former is somewhat optional, the latter is absolutely necessary and cannot be left to client-side JavaScript.