Who is going to validate the inputs to my DAO?

Question

I'm new to enterprise design patterns. I have been told data access objects are not suppose to validate their inputs. If some other layer is suppose to perform the validation then wouldn't that layer need to know all of the database details, such as table names and so fourth? Wouldn't that defeat the purpose of having a DAO by breaking encapsulation?

Perhaps my understanding of the DAO responsibility is off and the service layer is also suppose to have knowledge of the database, but that seems odd. Currently I have my data access objects only performing CRUD operations.

Note: I'm using ordinary servlets, no MVC framework or persistence framework.

Answer 1

A normal 3-tier application has an interface layer, a business layer and a data layer. The data layer is often a very thin cover over a database and generally doesn't do any validation other than sometimes it will validate string lengths for varchar columns.
Any business validation (such as not having numbers in usernames or not allowing spaces in passwords) would be done both on the interface layer (for performance reasons) and also in the business layer. If you find a sample web application somewhere, they should hopefully demonstrate this fairly clearly.