Validating External Data - php

Question

Below is an example of validation for user input from a form of a first name.
First name is Craig and must be max 40 characters.
// Check if not empty, type and not numeric
if (!empty($firstName) && is_string($firstName) && !is_numeric($firstName)) {
echo 'in fn passed 1 ' . '<hr />';
}
else {
echo 'in fn failed 1 ' . '<hr />';
}
// Check length
if ((strlen($firstName) > 1) && (strlen($firstName) < 41)) {
echo 'in fn passed 2 ' . '<hr />';
}
else {
echo 'in fn failed 2 ' . '<hr />';
}
// Accepts anything as long as it has a letter even if it contains < INJECTION RISK
if (preg_match('/[a-z]/', $firstName)) {
echo 'in fn passed 3 ' . '<hr />';
}
else {
echo 'in fn failed 4 ' . '<hr />';
}
My question is if I use the above for user input from a form should I have the same validation for database data and session data or am I over doing it.
From what I know it's all external data so the same would apply but I've seen so many examples where database and session data are treated differently I have a doubt.
Could someone please let me know what would be considered an adequate secure method of validating this first name from a form and if the same method should be used on database and session data.
Many thanks.
Craig.