The middle-tier should definiatly check this, since it qualify as a business ruke. That doesn't rule out however that you can validate it also in the UI, question of response time.

>Following on from your example, one thing I've just been looking at is validation of entered values.
>
>My first reaction was that the middle-tier should check validity of passed values, because the UI doesn't need to know what data can be accepted.
>
>So if say, entering a product code, you accidently put a space in the middle, should the middle-tier be the tier to pick that up and return an error code?