Validation in controllers

Hi, I was dealing with the same problem where to put validation and my conclusion is that, you can do both validation in controller (checking if format is correct and check against injections) and in model checking for data integrity. That means you can use model from different controllers/libraries and submit data and it will be valid until model it allows, if you decide configure form validation you simple edit controller where is only place that use form validation. Model can be used by many other classes. If you want to keep it as slim as possible use private function like it was suggested. This seams the most logical way.