Validate in two places: client (fast feedback via JS) and server (source of truth). Skipping server-side validation is how you get SQL injection and data corruption. Bonus: mask phone inputs to the format you actually want, and offer inline errors, not modal alerts.