That doesn't match my experience. Over half of the code I worked with was input validation (format validity, value plausibility, authorisations). Most of the

That doesn't match my experience. Over half of the code I worked with was input validation (format validity, value plausibility, authorisations). Most of the rest was post-facto batch checks for the same sorts of things, except more. Any CRUD code base that has been in use for a while is mostly this kind of thing.