3 ms·

Look, your email validation logic is very, very likely wrong

acmecorps 6y ago
I used to do complex email validations (like regexes etc), but have avoided using them for a long time. Currently, my email validations are 3 steps: 1. Using the <input type="email"> 2. Checking if "@" exists 3. Sending the actual email (which practically speaking - is the actual validation that I needed) Covers 99.99% of all cases I say.
- doggodaddo78 6y ago
  Yeap. \A.+@.+\z and try it.
xyzzy123 6y ago
Funnily enough the reason unusual email addresses were blocked in a lot of early CGI scripts was precisely to stop the wacky relaying and routing that the author points out could possibly happen given a sufficiently ancient mail setup. See e.g (PDF warning): http://www.city-fan.org/ftp/contrib/websrv/formmail-advisory.pdf http://www.city-fan.org/ftp/contrib/websrv/formmail-advisory... "Creative Recipient Addressing" People forget what a big problem spam used to be. And the utter insanity that ensued when you combined Perl CGI scripts with poorly configured Sendmail on dodgy hosts. I think "^[A-Z0-9+_.-]+@[A-Z0-9.-]+$" or similar got enshrined as "best practice" sometime back then and has survived to the present day by framework inertia and copy/paste transmission from sites with 10+ year old answers to "how to validate an email address". Now we've gotten to the point where it's probably OK to try to send to an "emoji cat face" or "<dog=cat>"a%b@c!d.e@foo.com but nobody really expects those to be reliably deliverable or usable for signup anymore. It's just a UX thing now. My observation is that if you use the dumb obvious regex but just give people the "+" in the local part, nobody will complain. Certainly not by email, anyway...
- doggodaddo78 6y ago
  The regex above is terribly wrong. Domains can use IDN while the local part allows UTF8. https://stackoverflow.com/questions/3844431/are-email-addresses-allowed-to-contain-non-alphanumeric-characters https://stackoverflow.com/questions/3844431/are-email-addres...
  - deleted 6y ago
    [deleted]
  - xyzzy123 6y ago
    Yeah I was really trying to make a comment about the "path dependence" that lead us to the validation we got. The last bit was flippant and I 100% agree with your comment.

I used to do complex email validations (like regexes etc), but have avoided using them for a long time. Currently, my email validations are 3 steps: 1. Using the <input type="email"> 2. Checking if "@" exists 3. Sending the actual email (which practically speaking - is the actual validation that I needed) Covers 99.99% of all cases I say.

doggodaddo78 6y ago
Yeap. \A.+@.+\z and try it.

xyzzy123 6y ago

Funnily enough the reason unusual email addresses were blocked in a lot of early CGI scripts was precisely to stop the wacky relaying and routing that the author points out could possibly happen given a sufficiently ancient mail setup. See e.g (PDF warning): http://www.city-fan.org/ftp/contrib/websrv/formmail-advisory.pdf http://www.city-fan.org/ftp/contrib/websrv/formmail-advisory... "Creative Recipient Addressing" People forget what a big problem spam used to be. And the utter insanity that ensued when you combined Perl CGI scripts with poorly configured Sendmail on dodgy hosts. I think "^[A-Z0-9+_.-]+@[A-Z0-9.-]+$" or similar got enshrined as "best practice" sometime back then and has survived to the present day by framework inertia and copy/paste transmission from sites with 10+ year old answers to "how to validate an email address". Now we've gotten to the point where it's probably OK to try to send to an "emoji cat face" or "<dog=cat>"a%b@c!d.e@foo.com but nobody really expects those to be reliably deliverable or usable for signup anymore. It's just a UX thing now. My observation is that if you use the dumb obvious regex but just give people the "+" in the local part, nobody will complain. Certainly not by email, anyway...

doggodaddo78 6y ago
The regex above is terribly wrong. Domains can use IDN while the local part allows UTF8. https://stackoverflow.com/questions/3844431/are-email-addresses-allowed-to-contain-non-alphanumeric-characters https://stackoverflow.com/questions/3844431/are-email-addres...
- deleted 6y ago
  [deleted]
- xyzzy123 6y ago
  Yeah I was really trying to make a comment about the "path dependence" that lead us to the validation we got. The last bit was flippant and I 100% agree with your comment.