Which status code should be used in response to invalid form input?

Short answer: 400 Bad Request, not 422 Unprocessable Entity.

Why?

Some argue that 422 Unprocessable Entity is better than 400 Bad Request. When solely looking at their definition, I agree. Even Ruby on Rails includes :unprocessable_entity and uses it as far as I know.

However, status code 422 is actually defined in WebDAV RFC 4918, not in HTTP RFC 7231. Hence, if you're developing anything else than a WebDAV service, 400 Bad Request is the correct status code to use in response to invalid form input.