This has been bugging me for a while now, and it finally came to me last week when I had to have this discussion with a couple of workmates and a client.

Data validation isn't all it's cracked up to be. This client has been having some terrible trouble with poorly trained and disciplined staff entering rubbish values into certain fields on important forms to get the forms to submit for processing. This has led to a bunch of bogus data entering the system and fouling up the works. Not a good thing in anyones book.

If you subscribe to the Alan Cooper religion, you'll be demanding that any good form should be able to be saved in an invalid state but it shouldn't be allowed to process until the state of the form is valid. And I'd agree with you. Up to a point.

The problem with validation is, it doesn't validate the intent of data. What I mean is, whether someone intended the data to be correct or not.

Take a fictional mortgage application form. Johnny Bobby, our not-to-educated call center drone, has been tasked with filling it out. He's pretty sure he's got all the data from the customer and he wants to save the application. He says goodbye and the customer hangs up. When he tries to save the application it fails, demanding that he put the estimated value of the property in. The customer has gone, and the phone is ringing hot. Johnny just wants to get on with it.

So, he types $400,000 into the field. It's a $300,000 mortgage, so the application falls within the LRV requirements for the particular product and it then allows him to save it. Of course, the property is only worth $25,000 but it's too late as the application has processed and the money has been given to the customer who promptly shoots through to Greece leaving the mortgage company to go bankrupt and everybody who works there DIES!!!

I may have exaggerated the last point, somewhat. Anyway, don't miss the actual point worth taking away. If someone intends to put in rubbish data, they will keep working the system until they figure out what it will accept. No matter how close it is to the real data, it's still rubbish. If a value is expected to fall between 75 and 100, and the actual value is 97, and the user puts in 80 just so they can dismiss the form, you've got rubbish data and it just passed validation.

So, how do you validate intent?