4 ms·

I wish people would stop using regex to validate email. Literally the only way you can check if an email address is a valid one is to send that address a valida

I wish people would stop using regex to validate email. Literally the only way you can check if an email address is a valid one is to send that address a validation email ("Click this link to confirm this is your email address" type thing). Validation emails also come with the added benefit of ensuring people enter their correct address (is not just randomly mashing the keyboard). Of course that doesn't stop them from using multiple addresses nor those burner address services, but neither would regex. The problem is validation emails take more dev time to build so some people get lazy and use form validation such as regex instead.

mratzloff 8y ago
Yes. About the only thing you can count on is `.+@.+`
- Xylakant 8y ago
  A little more elaborate would be [^@]+@[^@]+. It might still be possible to construct an email address that is valid and does not pass via comments in the address, but chances that this happens are low.
  - eadmund 8y ago
    That's a little more elaborate but, as you note, wrong. Just send email to the address.
  - majewsky 8y ago
    This does not match my favorite mail address, "@"@example.org
BjoernKW 8y ago
Validating email addresses with regular expressions can make sense from a UX perspective alongside sending a validation email after the address has been validated as "likely a valid email address". If for example during a typical registration process the software merely sends an email instead of also trying to validate the address first the user either has to wait until the email has arrived before entering the remaining data or otherwise might end up with invalid registration data that cannot be retrieved anymore. In this case, the user would have to start over again. This problem could be alleviated by having a two-step process, during which the software merely asks for the email address in the first step and the remaining data can only be filled in after the email address has been verified. However, depending on the requirements of the software it might make sense to not just ask for the email address but additional required information during the first step as well, in which case validating with regular expressions provides a better user experience through feedback.
- JdeBP 8y ago
  > Validating email addresses with regular expressions can make sense from a UX perspective ... only to people who are not listening to the complaints from users whose perfectly valid mailboxes are rejected by such systems. It seems somewhat hypocritical for designers to go on about "good user experience" when the user experience in practice turns out to be that it is impossible to give the system their actual electronic mail addresses at all. * https://github.com/kdeldycke/awesome-falsehood#emails https://github.com/kdeldycke/awesome-falsehood#emails
  - detaro 8y ago
    It'd be interesting to investigate if there's useful common error patterns that can be detected and then prompt the user to check. E.g. "you entered an e-mail address @gmmail.com. Did you mean @gmail.com?" Then you could do the hard-fail checks very conservatively and still catch some mistakes early.
  - BjoernKW 8y ago
    One solution would be to be lenient as to what address patterns to accept, e.g. using a regular expression such as /\S+@\S+/ that catches common entry errors but doesn't keep the user from entering uncommon but valid patterns. The idea here is to help the user avoid mistakes not to actually verify the email address. That's happening at a later stage, i.e. when the user clicks on a confirmation link.
    - wongarsu 8y ago
      >using a regular expression such as /\S+@\S+/ that catches common entry errors but doesn't keep the user from entering uncommon but valid patterns. your regex is too strict and doesn't accept all valid email addresses. my."really uncommon".email@is.valid is a valid email address that you would be rejecting. the sane regex is /.+@.+/. Anything beyond checking for an @ is getting into very complicated territory (even the domain part allows stuff like round and square brackets)
      - 8y ago
ballenf 8y ago
I don't care how they do it, so long as the service refuses to send any emails other than a confirmation email, until confirmed. My simple gmail address gets added to some new service by someone with a similar name at least once a week. And those services may or may not ask for confirmation, but then proceed to not care either way. It's super annoying. I get that people sometimes can't be bothered to confirm an account, but it still feels somehow very wrong.

mratzloff 8y ago

Yes. About the only thing you can count on is `.+@.+`

Xylakant 8y ago
A little more elaborate would be [^@]+@[^@]+. It might still be possible to construct an email address that is valid and does not pass via comments in the address, but chances that this happens are low.
- eadmund 8y ago
  That's a little more elaborate but, as you note, wrong. Just send email to the address.
- majewsky 8y ago
  This does not match my favorite mail address, "@"@example.org

BjoernKW 8y ago

Validating email addresses with regular expressions can make sense from a UX perspective alongside sending a validation email after the address has been validated as "likely a valid email address". If for example during a typical registration process the software merely sends an email instead of also trying to validate the address first the user either has to wait until the email has arrived before entering the remaining data or otherwise might end up with invalid registration data that cannot be retrieved anymore. In this case, the user would have to start over again. This problem could be alleviated by having a two-step process, during which the software merely asks for the email address in the first step and the remaining data can only be filled in after the email address has been verified. However, depending on the requirements of the software it might make sense to not just ask for the email address but additional required information during the first step as well, in which case validating with regular expressions provides a better user experience through feedback.

JdeBP 8y ago
> Validating email addresses with regular expressions can make sense from a UX perspective ... only to people who are not listening to the complaints from users whose perfectly valid mailboxes are rejected by such systems. It seems somewhat hypocritical for designers to go on about "good user experience" when the user experience in practice turns out to be that it is impossible to give the system their actual electronic mail addresses at all. * https://github.com/kdeldycke/awesome-falsehood#emails https://github.com/kdeldycke/awesome-falsehood#emails
- detaro 8y ago
  It'd be interesting to investigate if there's useful common error patterns that can be detected and then prompt the user to check. E.g. "you entered an e-mail address @gmmail.com. Did you mean @gmail.com?" Then you could do the hard-fail checks very conservatively and still catch some mistakes early.
- BjoernKW 8y ago
  One solution would be to be lenient as to what address patterns to accept, e.g. using a regular expression such as /\S+@\S+/ that catches common entry errors but doesn't keep the user from entering uncommon but valid patterns. The idea here is to help the user avoid mistakes not to actually verify the email address. That's happening at a later stage, i.e. when the user clicks on a confirmation link.
  - wongarsu 8y ago
    >using a regular expression such as /\S+@\S+/ that catches common entry errors but doesn't keep the user from entering uncommon but valid patterns. your regex is too strict and doesn't accept all valid email addresses. my."really uncommon".email@is.valid is a valid email address that you would be rejecting. the sane regex is /.+@.+/. Anything beyond checking for an @ is getting into very complicated territory (even the domain part allows stuff like round and square brackets)
    - 8y ago

ballenf 8y ago

I don't care how they do it, so long as the service refuses to send any emails other than a confirmation email, until confirmed. My simple gmail address gets added to some new service by someone with a similar name at least once a week. And those services may or may not ask for confirmation, but then proceed to not care either way. It's super annoying. I get that people sometimes can't be bothered to confirm an account, but it still feels somehow very wrong.