Personally, I use a two step validation process. The first is all javascript, which I use an onsubmit trigger to validate the input and not submit the form if there's an error, notify the user with alert. In the case that the user has javascript turned off, I have the same validation done on the page that the form is sent to, using php. If an error is found, I header redirect back to the form, with a get variable to tell the form what the error was.