Question: I have some information to enter in a text box. The data is structured and only some sequences are valid. For a phone number, for instance, a letter such as `A` is invalid.

So should I intercept keyboard events and prevent typed letters from reaching the text box, or should I draw some red squiggly lines (or another visual cue) to let my user know the letter is not acceptable? Which is a better user experience?

Answer: 
If you prevent invalid characters while they type, they could potentially think that their keyboard is malfunctioning. User's like things to work the way they expect them to. If you are going to prevent certain characters on key press, at the very least you should also display an error message near the input at the same time. This way they know why it isn't typing. 

Another thing that can get annoying is when you just finished filling out a long form and the site uses server side validation so you have to go back through the form to find what's wrong. I like to use client side validation primarily but fall back on server side. I will display an error either as they are typing or when the input loses focus. That way the user knows right away that there is an issue and knows exactly what the problem is.
I would suggest a hybrid of both approaches, but only for strictly-validated fields like phone numbers (SSN, zipcodes, etc ... anything that **must** be numeric by definition).

Track each keystroke and, when the user types an invalid character, show it ... but immediately signal that something's wrong. Maybe turn the input field red and display a "Please enter numeric characters only" to the right of the field.

Blocking input is a no-no because it can be misinterpreted by the user. They might assume a problem with their machine or input device, not that they weren't supposed to type a letter in a numeric entry box.

Validating *after* the input is completed can be annoying. Particularly with fields like those used in password creation. Some sites require 6-character passwords with only alphanumeric characters. Others require 9-character passwords and allow any character (including !@#$% and such). Typing a password and only finding out *after* I've typed it is the most annoying form type I've found and has actually turned me away from several services.

Providing dynamic feedback as the user enters data helps them

1. Know which field had the error while they're still in the field
2. Proactively correct input errors before submitting data
3. Learn from the experience as they go

Blocking input fails on all 3 accounts. Highlighting validation errors after the textbox is filled in fails on all 3 as well.