This isn't really a JavaScript tip, but you'd be better off using PHP to validate strings. It's much easier and it can't be fooled like JavaScript validation can.