 <p>With validation efficiency is not usually the concern. There are two types of validation that you should be concerned with:</p> <ol> <li>Input validation, e.g. will what the user is sending to the server malicious and intended to break/break into my application</li> <li>Business validation, which should happen in your business logic, and should be about maintaining valid, consistent values.</li> </ol> <p>Skipping over either of these is a very very good way to end up with either a hacked or badly broken application.</p> <p>If you're using ASP.net there are a plethora of libraries (mostly from Microsoft) to do the former, Anti-XSS lib etc.</p> <p>The latter would be most efficiently preformed in your shared business logic in the entities themselves. E.G your user entity should not allow an age of -1.</p>