What is the best way to validate a form, is it JS or PHP or a combination of both? Are they both secure, I realise this relies on how good the person writing the code is, but as a general rule?

JavaScript is not 'secure' as people could just disable it or HTTP post anything they wanted to the server without validating it. PHP is secure but is as you say only as good as the person writing it. Personally I don't bother with JavaScript validation at all, I let PHP validate my forms.

The PHP is there for security and validation. Adding Javascript on top is there for user experience only.