JavaScript would be good to keep the user from hitting Submit with a bad email address or phone number, but you really should be checking to make sure that it's valid data if they have JavaScript off, or are intentionally bypassing your form to try and break your server, right? Besides, it's fun coming up with messages to tell the script kiddies you're onto their game. :) IMHO, using both, with JavaScript as a first line of idiotproofing, doesn't really hurt.

andre germain
"Wherever you go, there you are."