Comparison questionMedium~7 min

Interview question

When should a rule be enforced by application validation, and when should it also be enforced by a database constraint?

Database constraints vs application validation

Explains database constraints versus application validation with practical data-access examples and production trade-offs.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

Application validation gives users early, specific feedback, while database constraints protect truth under concurrency and from every writer. I validate required values, formats, ranges, and known business rules in the application, then use NOT NULL, foreign keys, unique constraints, and check constraints for invariants the database can enforce. The two layers complement each other rather than compete.

Full answer below

Practice focus

Understanding of database constraints versus application validation, application and SQL behavior, API boundaries, production risks, and practical debugging or design judgment.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Application validation can explain a rule before a write, but it cannot protect the data from races or from every other writer. Database constraints are the final guard for invariants the database can express reliably.
Application validation gives users early, specific feedback, while database constraints protect truth under concurrency and from every writer. I validate required values, formats, ranges, and known business rules in the application, then use NOT NULL, foreign keys, unique constraints, and check constraints for invariants the database can enforce. The two layers complement each other rather than compete.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
A pre-check such as 'email is available' improves the experience but cannot guarantee uniqueness because two requests can pass it together. The unique constraint is the final authority, and the API maps its expected violation to a stable conflict or validation response. I avoid duplicating complex business workflows in database triggers, but I keep structural and cross-row invariants close to the data when the database can enforce them reliably.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
I document which layer owns each invariant and test the race, not only the friendly pre-check. Constraint names or provider error codes are translated without exposing SQL details to clients. Bulk imports, background jobs, maintenance scripts, and old application versions still meet the same database rules. Schema changes use a migration sequence that cleans existing bad data before adding a stricter constraint. For distributed ownership, a local database cannot enforce a remote service's fact, so the design needs a contract, reservation, or compensating workflow instead of a fictional cross-service foreign key.

Coding practice

Practice the problem like a real interview: restate, reason, implement, and test.

ExampleCandidatePractical exampleWalk through sample input and output.Open details

Details

For order numbers, the API can validate format, but the database should enforce uniqueness. If a unique constraint is violated, the API can return 409 Conflict with a stable error code.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Treating an application pre-check as a concurrency guarantee.
Returning raw constraint or provider details to the client.
Adding a constraint before cleaning existing invalid data.
Forcing workflow rules into triggers when the database cannot express their real ownership.

Red flagsCandidateSigns the approach is fragileSignals that an interviewer may treat as risky.Open details

Details

A uniqueness rule has no unique constraint.
Background jobs or imports can bypass the invariant.
Constraint violations become generic 500 responses.
The design assumes one database can enforce facts owned by another service.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

Why is an application uniqueness check not enough?
When should the API return 409 Conflict?
What rules belong in the database?
How do background jobs affect validation strategy?

Continue practice

No explicit flow link is set yet, so these are nearby drills from the same path or taxonomy.

ActionResult vs Typed ResultsComparison question / Medium / ~7 minContinue Tenant FiltersArchitecture scenario / Hard / ~12 minContinue API ConsistencySystem design / Hard / ~20 minContinue

Practice route

Read core answer Review checklist Follow-up prompts Track progress

Finished this drill?

Practice freely. Sign in only when you want to save completion, confidence, notes, or bookmarks.

New to Aporeon? Create account

Drill details

Technologies

SQL

Skill areas

API Design Backend APIs

Share the question with a concise Core-answer excerpt and invite other developers to add their perspective.

Was this drill useful?

Help improve the interview library.

Found this answer useful?

Say thanks with a standalone, one-time $5 contribution. No account required.

No subscription or perks.Choose another amount

Human editorial direction

Aporeon is shaped by Aleksandar Tomovski, a software developer with experience on both sides of technical interviews. Content is reviewed for accuracy, natural spoken delivery, useful depth, and honest trade-offs.

About the creator Editorial standards

Opening drill

Comparison questionMedium~7 min

Interview question

When should a rule be enforced by application validation, and when should it also be enforced by a database constraint?

Database constraints vs application validation

Explains database constraints versus application validation with practical data-access examples and production trade-offs.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

Full answer below

Practice focus

Understanding of database constraints versus application validation, application and SQL behavior, API boundaries, production risks, and practical debugging or design judgment.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Application validation can explain a rule before a write, but it cannot protect the data from races or from every other writer. Database constraints are the final guard for invariants the database can express reliably.
Application validation gives users early, specific feedback, while database constraints protect truth under concurrency and from every writer. I validate required values, formats, ranges, and known business rules in the application, then use NOT NULL, foreign keys, unique constraints, and check constraints for invariants the database can enforce. The two layers complement each other rather than compete.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
A pre-check such as 'email is available' improves the experience but cannot guarantee uniqueness because two requests can pass it together. The unique constraint is the final authority, and the API maps its expected violation to a stable conflict or validation response. I avoid duplicating complex business workflows in database triggers, but I keep structural and cross-row invariants close to the data when the database can enforce them reliably.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
I document which layer owns each invariant and test the race, not only the friendly pre-check. Constraint names or provider error codes are translated without exposing SQL details to clients. Bulk imports, background jobs, maintenance scripts, and old application versions still meet the same database rules. Schema changes use a migration sequence that cleans existing bad data before adding a stricter constraint. For distributed ownership, a local database cannot enforce a remote service's fact, so the design needs a contract, reservation, or compensating workflow instead of a fictional cross-service foreign key.

Coding practice

Practice the problem like a real interview: restate, reason, implement, and test.

ExampleCandidatePractical exampleWalk through sample input and output.Open details

Details

For order numbers, the API can validate format, but the database should enforce uniqueness. If a unique constraint is violated, the API can return 409 Conflict with a stable error code.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Treating an application pre-check as a concurrency guarantee.
Returning raw constraint or provider details to the client.
Adding a constraint before cleaning existing invalid data.
Forcing workflow rules into triggers when the database cannot express their real ownership.

Red flagsCandidateSigns the approach is fragileSignals that an interviewer may treat as risky.Open details

Details

A uniqueness rule has no unique constraint.
Background jobs or imports can bypass the invariant.
Constraint violations become generic 500 responses.
The design assumes one database can enforce facts owned by another service.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

Why is an application uniqueness check not enough?
When should the API return 409 Conflict?
What rules belong in the database?
How do background jobs affect validation strategy?

Continue practice

No explicit flow link is set yet, so these are nearby drills from the same path or taxonomy.

ActionResult vs Typed ResultsComparison question / Medium / ~7 minContinue Tenant FiltersArchitecture scenario / Hard / ~12 minContinue API ConsistencySystem design / Hard / ~20 minContinue

When should a rule be enforced by application validation, and when should it also be enforced by a database constraint?

Practice focus

Answer path

Why this question matters

Coding practice

Review signals

Follow-up prompts

Continue practice

When should a rule be enforced by application validation, and when should it also be enforced by a database constraint?

Practice focus

Answer path

Why this question matters

Coding practice

Review signals

Follow-up prompts

Continue practice