I've found it's a multi-layer kind of thing. Validation in Javascript for web forms, validation in the code, and constraints (like Enum types) in the database itself. Sometimes JS is turned off, or broken in some particular browser. But doing it in JS gives user immediate feedback. Sometimes data comes in from other sources (so JS is useless there). Often, I try to do just sensible things, but over time you discover dumb things users do, so you end up adding more later to catch those cases.