Best way to implement validation rules

I used to store validation in controllers. I just create a method containing rules and messages, so it can be used by one or more methods. I usually make a separation between the app and database by its controller and model. Every data should pass validation in controller before they sent to model to be inserted to database.