Requirement number four covers a now obsolete form that is arguably permissive. Agents issuing new addresses could legitimately disallow it; however, an existing address that uses this form remains a ...

You can use PHP's filter functions to filter/validate the form input. Here is a good tutorial to get you started. The email and URL filters aren't great (there was a recent discussion here on that ...