3 ms·
You might want “clean” or “normal” addresses too (for whatever reason). For example, disallowing “+” would just give you the canonical email instead of one that
by alkonaut 5y ago
You might want “clean” or “normal” addresses too (for whatever reason). For example, disallowing “+” would just give you the canonical email instead of one that risks being tagged with a unique ID revealing who leaked it.
Being too generous in the early input validation regex (e.g just check for non empty and containing one @) risks making registrations fail and customers not returning. This seems like a much bigger risk than locking anyone out who has a weird email Even a character beyond [a-z0-9-_] or domain without tld is probably worth rejecting.
- puffoflogic 5y ago`+` is a legal part of the mailbox name everywhere but gmail (and gmail clones). Broken "checks" like these are exactly what the simple validation is avoiding.
- alkonaut 5y agoIf people who use '+' on purpose are fewer than those who type it in error (who type bobsmith+ when they meant bobsmith0, then it might not be a good idea. The entire argument I was trying to make was that what constitutes a "legal email address" is not always what you want to validate. That some providers allow using '+' isn't as important as the number of users that actually do. If some nontrivial number of users use + on purpose, then don't reject them.
- remram 5y agoWhy do you believe that? What do you gain by rejecting '+', no matter how few people need it to work?
- puffoflogic 5y agoYou should also reject `z` in emails. The number of users who type this accidentally no doubt greatly exceeds the number who actually have that letter in their email address.