Input validation routines serve as a first line of defense for a Web application. Regular Expressions are a great and robust way to validate input.
If you make unfounded assumptions about the type, length, format, or range of input, your application is unlikely to be robust. Input validation can become a security issue if an attacker discovers that you have made unfounded assumptions. The attacker can then supply carefully crafted input that compromises your application by attempting SQL injection, cross-site scripting, and other injection attacks. To avoid such vulnerability, you should validate text fields (such as names, addresses, tax identification numbers, and so on) and use regular expressions.
For example, instead of just adding a required field for a last name input you use the following expression to allow only uppercase and lowercase characters and a few special characters that are common to some names.
^[a-zA-Z''-'\s]{1,40}$