Preventing custom form validation function from being accessed via a URL

Put your custom validation in a model. A model can call another model. in my occasionally humble opinion all validation should happen in models to keep the controller as thin as possible. in my not so humble opinion every method in a controller should be private unless its ok for it to be accessible via the url, because that is basic security.