4 ms·
Validate emails in a manner that is representative of the typical use of your service. If it’s a specialist email processing tool, then you should probably fol
by VincentEvans 5y ago
Validate emails in a manner that is representative of the typical use of your service.
If it’s a specialist email processing tool, then you should probably follow an RFC.
If it’s a dating app, you can probably just use a regex that covers common cases to help users avoid typos.
I think the decision is similar to the one picking how modern are the browsers you are going to support. It’s a trade-off. That’s my take on it, don’t have a cow, man.
- remram 5y agoYou will want to check ownership by sending a verification email anyway. If you want to avoid typos, show a "are you sure... yes/no" warning, there is no need to block anybody. Typos will overwhelmingly lead to valid-looking addresses anyway.
- kube-system 5y agoI usually just validate that there’s an “@” character. It prevents the most obvious typos like a blank field, or information entered in the wrong field. You’re right that you can’t prevent someone from typing their address incorrectly, but you can make sure they didn’t put in their phone number or their first name by mistake
- deleted 5y ago[deleted]
- lkbm 5y agoMailgun has an API endpoint that works pretty well. If you enter "foo@gnail.con", it suggests "foo@gmail.com". It's overkill for an HN registration form, where if I type my email wrong, I can just re-register, but for checkout forms it can be worth putting in a little extra validation.
- VincentEvans 5y agoI agree, but there are all kinds of scenarios where you might need to simply answer a question - “is this an email address, and does it look valid?”. I needed to do just that once - I was given a flat file with some bulk export data that came from some other system that I had no exposure to and needed to clean up contact data by figuring out what was what, separating names from phone numbers, from postal addresses, from emails, etc. It just needed some rate of success, not to be perfect. Lets not assume that we always know what people are trying to do and what is the best way to do it. Devil is in the details.
- remram 5y agoExtraction is not validation. I generally agree with you, but your previous message (about "a dating app") left little to assumption.
- alkonaut 5y agoYou might want “clean” or “normal” addresses too (for whatever reason). For example, disallowing “+” would just give you the canonical email instead of one that risks being tagged with a unique ID revealing who leaked it. Being too generous in the early input validation regex (e.g just check for non empty and containing one @) risks making registrations fail and customers not returning. This seems like a much bigger risk than locking anyone out who has a weird email Even a character beyond [a-z0-9-_] or domain without tld is probably worth rejecting.
- puffoflogic 5y ago`+` is a legal part of the mailbox name everywhere but gmail (and gmail clones). Broken "checks" like these are exactly what the simple validation is avoiding.
- alkonaut 5y agoIf people who use '+' on purpose are fewer than those who type it in error (who type bobsmith+ when they meant bobsmith0, then it might not be a good idea. The entire argument I was trying to make was that what constitutes a "legal email address" is not always what you want to validate. That some providers allow using '+' isn't as important as the number of users that actually do. If some nontrivial number of users use + on purpose, then don't reject them.
- remram 5y agoWhy do you believe that? What do you gain by rejecting '+', no matter how few people need it to work?
- puffoflogic 5y agoYou should also reject `z` in emails. The number of users who type this accidentally no doubt greatly exceeds the number who actually have that letter in their email address.
- eli 5y agoI'm not sure there are even many SMTP servers that fully follow the RFC. Embedded comments in an email address is a weird feature.