4 ms·
But why restrict the syntax arbitrarily in the first place? It is not going to catch the common typos anyway. Most typos will just result in a wrong but still s
by goto11 5y ago
But why restrict the syntax arbitrarily in the first place? It is not going to catch the common typos anyway. Most typos will just result in a wrong but still syntactically valid email address.
- harryf 5y agoI’ve always wondered if it’s possible to have a valid email address which is also an SQL injection attack, XSS or similar ?
- malinens 5y agoof course it can: https://security.stackexchange.com/a/106996 https://security.stackexchange.com/a/106996 One of our testers found XSS with email injection (RFC compkiant validation passed) in our website. And we are an e-mail company and should now better :D Never trust user input!
- goto11 5y agoProbably, since the local name part can be basically anything. But the way to prevent injection attacks is not to disallow or sanitize input, it is to escape correctly when interpolating strings in other languages.