3 ms·
I’ve never seen much point in trying to do better than .+@.+, unless you’re going to pull out the (gargantuan!) authoritative version for some reason.
by burke 5y ago
I’ve never seen much point in trying to do better than .+@.+, unless you’re going to pull out the (gargantuan!) authoritative version for some reason.
- michaelt 5y agoToo many sites refuse to let me register as "><script>alert("XSS");</script>@example.com The oppression must end!
- SAI_Peregrinus 5y agoI think the mismatched quotes actually do make that one invalid.
- mro_name 5y agoshouldn't is read Bobby Tables rather than a mere XSS?
- Avamander 5y agoHonestly if that'd ever work, the website has bigger problems anyways.
- kevinmchugh 5y agoImplementing the authoritative version is a waste since you'll also need to keep an up-to-date list of TLDs, and more importantly, you might have a typo in the input that gives a valid-but-incorrect email. After doing your simple regex, the best move is to just send a verification email and wait for the user to click the link, if you really need to be sure.
- wffurr 5y agoYeah, do simple validation, and then just send an email. Even a validated email can still be non-deliverable if there’sa typo in the domain or the first portion.
- dkersten 5y agoOr the user typos their address and it goes to the void or to someone else. Even a valid address can’t be assumed correct. I get a ton of emails to my old gmail that aren’t meant for me because some people are too dumb to get their email addresses correctly (even for someone’s covid vaccination appointment confirmation and details recently...) or just make a mistake.
- kristaps 5y agoYep, these arcane rules are maybe relevant to the 5 or so people writing mailservers, but not to web developers.