Where in code validate/sanitize inputs?

I am going to give my opinion for what it's worth.

Put it in the place that makes the most sense.

For example:

• When getting input from the user that needs sanitising, put that in the controller.
  
• When checking the calculations or output from a business process, do it there.
  
• When passing data from one place to another, make sure that the data arriving is reasonable, so check it there.
  

As you can see, there is no one best place. it needs to be done at the input to your libraries, at the input of your controllers. Really anywhere that data can arrive bad and that will then have a knock on effect on the rest of your application.

Make the data clean and worry less about where you check and clean it up.

Try hard to avoid GIGO (Garbage In, Garbage Out)