Validate what the field means
Check both structure and meaning: a value can be a valid number and still fall outside an allowed range. Define accepted types, lengths, and business rules.
Enforce rules on the server
Client checks are helpful feedback. Repeat the important rules on the server, where a caller cannot bypass them by changing the page.
Handle output separately
Do not treat validation as an XSS solution. Encode output for its destination and use parameterized database operations. Different contexts need different protections.