diff --git a/webapp/controller/HeroController.class.php b/webapp/controller/HeroController.class.php
index 653d1cc9..1f62578d 100644
--- a/webapp/controller/HeroController.class.php
+++ b/webapp/controller/HeroController.class.php
@@ -512,6 +512,30 @@ class HeroController extends BaseAuthedController {
     {
         $heroUniId = getReqVal('hero_uniid', 0);
         $heroDb = Hero::find($heroUniId);
+        if (!$heroDb) {
+            $this->_rspErr(100, 'server internal error');
+            return;
+        }
+        $heroMeta = mt\Hero::get($heroDb['hero_id']);
+        if (!$heroMeta) {
+            $this->_rspErr(100, 'server internal error');
+            return;
+        }
+        $currQualityMeta = mt\HeroQuality::getByQuality($heroDb['quality']);
+        if (!$currQualityMeta) {
+            $this->_rspErr(100, 'server internal error');
+            return;
+        }
+        $nextQualityMeta = mt\HeroQuality::getByQuality($heroDb['quality'] + 1);
+        if (!$nextQualityMeta) {
+            $this->_rspErr(5, "It's already the highest level1");
+            return;
+        }
+        $nextLevelMeta = mt\HeroLevel::getByLevel($heroDb['hero_lv']);
+        if (!$nextLevelMeta) {
+            $this->_rspErr(5, "It's already the highest level2");
+            return;
+        }
     }
 
 }