It seems like you are looking for a generalized way to allow certain groups of characters (primarily), with an addition to allow certain strings.

First, think about which chars you'd like to allow. Since this is a phone number, these are spaces, digits, hyphens, parentheses, and periods (dots). The key here is that this is the class of chars you'd like to allow. So, to check if a form has only these chars

# true if $string consists solely of allowed chars (and isn't empty)
$string =~ m/^[\s\d-\(\)\.]+$/;

# or, we could be true if $string contains anything except allowed cha
+rs
$string =~ m/[^\s\d-\(\)\.]/;
[download]

The second approach uses the char-class negation -- the regex will be true if it finds at least one char not in the set. I like this approach less, so the remainder of examples will follow the other pattern (true if "good").

Your next step is to deal with how people might specifiy extentions. The forms I have seen are "x1234", variations on "ext. 1234", and "(1234)". The last is already addressed in the regex we have, because it uses all legal chars. We address the first option ("x1234") by adding 'x' as a legal char in our class. We then deal with the ways we can allow the "ext. 1234" style by checking for the forms of "ext." (I choose to allow "ext" and "Ext" with an optional period.

$string =~ m/^[\s\d-\(\)\.x]+|(?:[Ee]xt[\.]*)*$/;
[download]

Now, that's fairly complex and somewhat hard to understand if you don't already grok regex. It's also easy to make a mistake maintaining it. Here's an alternate approach:

sub is_valid {
    # check to see if an entry consists of valid "phone number" chars.
    my ($phone) = @_;

    $phone =~ s/[\-\.\s\(\)]+//g; #remove punct. and spaces

    # return 1 if begins with digits and is followed by
    # Ext or ext or x and digits.
    return ( $phone =~ m/^\d+(?:(?:[Ee]xt)|x)*\d$/ );
}
[download]

By removing spaces and punctuation, we've made our task a little easier: we can validate that something has all legal chars, and do a minimal level of format checking as well (e.g. extentions must be at the end, if provided; everything begins and ends with digits {not counting puctuation}, etc.).

This might be used like:

unless ( is_valid($FORM{'phone'} ) {
    send_error("$FORM{'phone'} doesn't meet validity test");
    exit;
}
[download]

If readability isn't a concern (but really, when isn't it?), you could combine the ideas into a complex regex:

$phone =~ m{^\d+[\d\-\.\s\(\)]+(?:(?:[Ee]xt[\.]*)|x)*\d$};
[download]

All said, you might find it easier to alter your entire approach, creating an HTML form that has two fields, 'phone' and 'ext', then checking that the 'phone' is all digits and punctuation and the ext is all digits (or empty). Like this:

# valid number
unless ($FORM{'phone'} =~ /^\d+[\s\d-\(\)\.]+$/) {
   die "Bad phone";
}

#valid ext, if it exists
unless ($FORM{'ext'} =~ /^\d+$/) {
   # don't die if zero-length!
   die "Bad ext" if length($FORM{'ext'});
}
[download]

These regexen and code snippets are untested, and so might have some problems. Not nearly enough coffee today -- don't say I didn't warn you!