8 ms·

Valid Email Addresses

50 points by ry0ohki 14y ago

nthitz 14y ago
I don't care for overaggressive email validators myself, but if you are registering with my service using an email of ""()<>[]:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org" I'll probably want you to enter something more reasonable. Anyway just because it is valid according to the RFC, doesn't mean that it's actually a valid user's email address.
- jacquesm 14y ago
  I guess I won't be using your service then! Quite frequently I find that services will not accept my perfectly valid email address as valid. This is on the whole their loss, since if they can't even properly validate an email address there are probably more loose ends and I'd rather not find out which.
  - bwilliams 14y ago
    It's a bit extreme to correlate not being able to validate an email address (that isn't in a common format) to having other loose ends.
    - jacquesm 14y ago
      My email address is in a very common format.
      - kbolino 14y ago
        Please be mindful that you responded to a post citing the example of ""()<>[]:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org" That address is not "common" even if it is technically valid. If you want to talk about your own email address, you should provide a sample address that is similar so we know what you're talking about. [edit: I see your address in your profile. It is nothing like the example given.]
      - simcop2387 14y ago
        If it's the one that you have on some of your social media sites, nice. I can suspect why they reject it but is it primarily because of the short length?
        jacquesm 14y ago
        At a guess the problem is probably a code snippet that checks for minimum length. You could have an even shorter one for a single letter domain in a two letter tld, for instance x@y.nu
  - digitalsushi 14y ago
    On the whole, it's probably not a loss. It's probably a gain. On the whole, they validated almost all of the email addresses. They spent their corner case money instead on making the product awesome, and instead of poor []:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org getting a copy, everyone else got something better.
    - fayden 14y ago
      Why not use a librairy that validates emails? You save time, and you actually accept valid emails. I agree that the example with a lot of symbols is over the top, but when a website doesn't accept foo+bar@host.com, I assume the product will be sub-par quality wise. The author did not follow of rigorous process for something as simple as email validation, I doubt he'll be more rigorous in other parts of his project.
      - pyre 14y ago
        There are other concerns too. I submitted a bug report to Zappos because their emailer did not URL-escape '+' in foo+bar@example.com. Resulting in: http://www.zappos.com/?email=foo+bar@example.org which was treated as: http://www.zappos.com/?email=foo%20bar@example.org by the browser. It worked fine when I manually encoded the '+'.
      - michaelhoffman 14y ago
        I've given up on using + addresses. As other people have pointed out, the worst thing about them is that sometimes you will find that it works initially but will break other parts of the application now or later. For example, account creation works fine, but in two years, you can no longer log in.
    - baddox 14y ago
      I don't understand. Won't a correct-to-spec validation procedure take about as long to implement as an ad hoc procedure? I'm guessing a maximum of two developer-hours, and that's if you're extremely careful (i.e. unit tests).
  - rsenk330 14y ago
    I run into this a lot using a "+" in my Gmail address. I like to use "username+site_name@gmail.com" for easy filtering, but there are still quite a large number of sites that do not accept this as valid, and it is extremely annoying.
    - abrowne 14y ago
      Years ago, I must have signed up or given my email address to Urban Outfitters with a +uo. They happily continue to send me emails, but their unsubscribe form does not accept it as a valid address! I've tried reporting the bug, but now just send the messages straight to spam.
      - jfoutz 14y ago
        I think you can get paid $25 for each and every one of those. You've made every effort to unsubscribe, and they're still spamming you.
  - deleted 14y ago
    [deleted]
  - lanstein 14y ago
    I remember what it is, and you're completely right - it's certainly legitimate and legible (though unusual ;) ).
  - nthitz 14y ago
    Accepting "()<>[]:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org versus accepting j@ww.com Hardly a valid comparison. Yes my theoretical non existant service would validate addresses like yours. That is vastly different to the one I mentioned.
    - sil3ntmac 14y ago
      No, but I like to use e.g. joe+SERVICE_NAME@gmail.com and a lot of places flag this as an invalid address. There are use cases.
      - AgentConundrum 14y ago
        I once had an issue with a ticket purchasing website which accepted my "name+SERVICE" email address when I signed up, but it refused it when I tried to sign in later, or possibly just when I was trying to use the "forgot password" functionality - it's been a while. Either way, I was effectively locked out of a website that was storing my credit card information. Since I was in a hurry to buy the tickets (a last minute gift), I signed up for a second account without the "+SERVICE" section, bought the tickets, and sent them an email asking them to either merge the accounts, delete the old one, or otherwise allow me access the other account so I could purge my credit card data. What happened next was a bit shocking. They sent me an email back a few days later saying that they had fixed the issue with my account by removing the '+' symbol. The risk of exploit was relatively low due to the extreme obscurity, but it was technically possible for a short while for a person to go to my email provider and register the username "nameSERVICE" and access my account on the ticketing website, including my credit card information.
        Terretta 14y ago
        The sites that let you sign up using the + and then don't work later tend to be using URL encoding/decoding and converting that + into a space in some cases but not in others.
- dfc 14y ago
  "just because it is valid according to the RFC, doesn't mean that it's actually a valid user's email address." I'm sorry but abiding by the RFC is the definition of a valid email address. Postel said it best "be conservative in what you do, be liberal in what you accept from others."
  - tbrownaw 14y ago
    A "valid" email address does not have to mean a "well-formed" email address.
    - dfc 14y ago
      Without getting too existential what else could "valid" possibly mean.
      - randallsquared 14y ago
        One that someone is using to accept mail.
  - nthitz 14y ago
    Just because myname@xyz.com is valid according to the RFC does not mean xyz.com is an existing domain name with a mail server setup that an account 'myname', let alone that user who inputted actually has access to that account. Just send a validation email
    - dfc 14y ago
      You are confusing "valid email address" with "a valid email address, functioning mail server and user with appropriate credentials to access the system that processes email for the supplied email address."
      - randallsquared 14y ago
        What you quoted was "valid user's email address", not "valid email address". While "valid email address" is arguable, a "valid user"'s email address is more clearly about whether it accepts mail. :)
dutchbrit 14y ago
For people validating emails in PHP, use the following code: filter_var($email, FILTER_VALIDATE_EMAIL); The actual beast: https://github.com/php/php-src/blob/master/ext/filter/logical_filters.c#L499 https://github.com/php/php-src/blob/master/ext/filter/logica...
- ry0ohki 14y ago
  oh wow had no idea that existed, thank you!
jayferd 14y ago
Why do email addresses need comments again?
- digitalsushi 14y ago
  It helps you remember to whom you gave the address. mikec+farmville@digitalsushi.com is a nice comment that tells me "I used this for farmville; who is now emailing me with it?"
  - ben0x539 14y ago
    A malicious sender could just strip out your +whatever, and then you are where you started, unless you already filter all mail without a + part and give all your friends a salted email address.
  - eli 14y ago
    No, that's not a comment. That plus sign is part of the email address. It's up to your mail server how to figure out how to parse it and stuff it into the correct inbox. The RFC allows for actual nested comments to appear within the address. Though nobody actually uses this and really the RFC is talking about formatting for email messages in transit, not how you should or shouldn't record your address on a form.
  - jimktrains2 14y ago
    I don't think that's what OP meant. You can have comments like first.last(notify IM)@example.com see http://blog.dominicsayers.com/2009/02/27/comments-in-email-addresses/ http://blog.dominicsayers.com/2009/02/27/comments-in-email-a... I just don't understand why they made the spec so complex. Seriously, indefinably nestable comments?
spindritf 14y ago
> Invalid email addresses > Abc.example.com (an @ character must separate the local and domain parts) Well, that also depends on the context because replacing @ with a dot is exactly what you'd do in a zone file: $ dig soa google.com +short ns1.google.com. dns-admin.google.com. 2012113000 7200 1800 1209600 300 So it gets even hairier.
- duskwuff 14y ago
  Well, yes. But at that point it's no longer an email address.
neya 14y ago
There's a reason why most of those valid email addresses are not allowed by most email providers. As an example, in the 1997-early 2000's, underscores were very popular amongst the internet users and most of them had an underscore in their E-mail addresses. Whilest applying for a job, they would fill out a form in the employer's website/some form application software where the data is then later tabulated. Once tabulated, the entire email address would be underlined by many popular softwares back then, since it's (was) essentially considered as a link. Then, while the recruiters were trying to copy and paste these prospective e-mail ID's in their respective email clients, the underscore would be missed out and would have just a space instead (which the recruiters have no idea as to why) and thus the recipients would miss out from receiving these emails. Hence, many email providers wouldn't allow one to register an underscore (or any complex character) after receiving many such reports, just to avoid these hassles.
alpb 14y ago
Here's what a RFC-compliant email address regex looks like: http://www.ex-parrot.com/~pdw/Mail-RFC822-Address.html http://www.ex-parrot.com/~pdw/Mail-RFC822-Address.html Hint: God damn long.
eli 14y ago
It's weird how often email address validation comes up on HN. I think it must be bike shedding for the web app generation. It's the simplest piece of a common web app for which there could possibly be any discussion or disagreement. Yes, you can have a crazy looking email address. But that doesn't mean you should. And you have no right to expect a web form will let you enter your address with nested comments. On the other hand, a lot of developers seem to confuse validating an email address against the RFC with confirming that it is the user's true and correct address. This is not possible without sending the address a message. Regardless of how good your regex is, it will let many typos through and it will fail to stop "fake@fake.com". I'd suggest spending time elsewhere.
- meritt 14y ago
  Agreed. When damn near every application today requires the user to click a link sent to their email, I can't envision any reason for actually validating the email at form submission time (except len <= 254). If they click the activation link, it's a legitimate user. End of story.
  - dbaupp 14y ago
    And inclusion of @.
  - bjt 14y ago
    If you're trying to optimize a registration process, you want to minimize the number of people you lose at each step. If someone gives you a bad email address, and then you try to send the activation link there, you've lost that registration. If you catch it when they submit the form then you've got a better shot at getting a complete registration from that user.
    - fhars 14y ago
      But there are several businesses that tried to do exactly that and lost me as a customer since they didn't accept my perfectly valid address with a + in it.
nofinator 14y ago
Someone should update this McSweeney's list: http://www.mcsweeneys.net/articles/e-mail-addresses-it-would-be-really-annoying-to-give-out-over-the-phone http://www.mcsweeneys.net/articles/e-mail-addresses-it-would...
- edmond_dantes 14y ago
  A contemporary "Who's on first?" scenario.
unreal37 14y ago
I had no idea that email addresses could be so complex. ""()<>[]:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org" is valid? It won't be a popular view around here, but that SHOULDN'T be valid. The spec needs to change. I won't be making changes to any of the large sites that my company manages to accept weird characters like brackets, semicolons and quotation marks as a valid email address. That's just asking for a XSS or SQL injection attack and other trouble. Sorry, but the spec is just wrong here.
- mcguire 14y ago
  This is probably not a popular view around here either, but if you're examining the contents of the string to avoid XSS or SQL injection attacks, you're doing it wrong.
- mrb 14y ago
  You sound like a lazy developer who doesn't want to learn the proper way to protect against XSS and SQL injection. If you have this mentality, your code probably has similar vulnerabilities in pieces of data other than the email address.

50 points by ry0ohki 14y ago

I don't care for overaggressive email validators myself, but if you are registering with my service using an email of ""()<>[]:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org" I'll probably want you to enter something more reasonable. Anyway just because it is valid according to the RFC, doesn't mean that it's actually a valid user's email address.

jacquesm 14y ago
I guess I won't be using your service then! Quite frequently I find that services will not accept my perfectly valid email address as valid. This is on the whole their loss, since if they can't even properly validate an email address there are probably more loose ends and I'd rather not find out which.
- bwilliams 14y ago
  It's a bit extreme to correlate not being able to validate an email address (that isn't in a common format) to having other loose ends.
  - jacquesm 14y ago
    My email address is in a very common format.
    - kbolino 14y ago
      Please be mindful that you responded to a post citing the example of ""()<>[]:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org" That address is not "common" even if it is technically valid. If you want to talk about your own email address, you should provide a sample address that is similar so we know what you're talking about. [edit: I see your address in your profile. It is nothing like the example given.]
    - simcop2387 14y ago
      If it's the one that you have on some of your social media sites, nice. I can suspect why they reject it but is it primarily because of the short length?
      - jacquesm 14y ago
        At a guess the problem is probably a code snippet that checks for minimum length. You could have an even shorter one for a single letter domain in a two letter tld, for instance x@y.nu
- digitalsushi 14y ago
  On the whole, it's probably not a loss. It's probably a gain. On the whole, they validated almost all of the email addresses. They spent their corner case money instead on making the product awesome, and instead of poor []:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org getting a copy, everyone else got something better.
  - fayden 14y ago
    Why not use a librairy that validates emails? You save time, and you actually accept valid emails. I agree that the example with a lot of symbols is over the top, but when a website doesn't accept foo+bar@host.com, I assume the product will be sub-par quality wise. The author did not follow of rigorous process for something as simple as email validation, I doubt he'll be more rigorous in other parts of his project.
    - pyre 14y ago
      There are other concerns too. I submitted a bug report to Zappos because their emailer did not URL-escape '+' in foo+bar@example.com. Resulting in: http://www.zappos.com/?email=foo+bar@example.org which was treated as: http://www.zappos.com/?email=foo%20bar@example.org by the browser. It worked fine when I manually encoded the '+'.
    - michaelhoffman 14y ago
      I've given up on using + addresses. As other people have pointed out, the worst thing about them is that sometimes you will find that it works initially but will break other parts of the application now or later. For example, account creation works fine, but in two years, you can no longer log in.
  - baddox 14y ago
    I don't understand. Won't a correct-to-spec validation procedure take about as long to implement as an ad hoc procedure? I'm guessing a maximum of two developer-hours, and that's if you're extremely careful (i.e. unit tests).
- rsenk330 14y ago
  I run into this a lot using a "+" in my Gmail address. I like to use "username+site_name@gmail.com" for easy filtering, but there are still quite a large number of sites that do not accept this as valid, and it is extremely annoying.
  - abrowne 14y ago
    Years ago, I must have signed up or given my email address to Urban Outfitters with a +uo. They happily continue to send me emails, but their unsubscribe form does not accept it as a valid address! I've tried reporting the bug, but now just send the messages straight to spam.
    - jfoutz 14y ago
      I think you can get paid $25 for each and every one of those. You've made every effort to unsubscribe, and they're still spamming you.
- deleted 14y ago
  [deleted]
- lanstein 14y ago
  I remember what it is, and you're completely right - it's certainly legitimate and legible (though unusual ;) ).
- nthitz 14y ago
  Accepting "()<>[]:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org versus accepting j@ww.com Hardly a valid comparison. Yes my theoretical non existant service would validate addresses like yours. That is vastly different to the one I mentioned.
  - sil3ntmac 14y ago
    No, but I like to use e.g. joe+SERVICE_NAME@gmail.com and a lot of places flag this as an invalid address. There are use cases.
    - AgentConundrum 14y ago
      I once had an issue with a ticket purchasing website which accepted my "name+SERVICE" email address when I signed up, but it refused it when I tried to sign in later, or possibly just when I was trying to use the "forgot password" functionality - it's been a while. Either way, I was effectively locked out of a website that was storing my credit card information. Since I was in a hurry to buy the tickets (a last minute gift), I signed up for a second account without the "+SERVICE" section, bought the tickets, and sent them an email asking them to either merge the accounts, delete the old one, or otherwise allow me access the other account so I could purge my credit card data. What happened next was a bit shocking. They sent me an email back a few days later saying that they had fixed the issue with my account by removing the '+' symbol. The risk of exploit was relatively low due to the extreme obscurity, but it was technically possible for a short while for a person to go to my email provider and register the username "nameSERVICE" and access my account on the ticketing website, including my credit card information.
      - Terretta 14y ago
        The sites that let you sign up using the + and then don't work later tend to be using URL encoding/decoding and converting that + into a space in some cases but not in others.
dfc 14y ago
"just because it is valid according to the RFC, doesn't mean that it's actually a valid user's email address." I'm sorry but abiding by the RFC is the definition of a valid email address. Postel said it best "be conservative in what you do, be liberal in what you accept from others."
- tbrownaw 14y ago
  A "valid" email address does not have to mean a "well-formed" email address.
  - dfc 14y ago
    Without getting too existential what else could "valid" possibly mean.
    - randallsquared 14y ago
      One that someone is using to accept mail.
- nthitz 14y ago
  Just because myname@xyz.com is valid according to the RFC does not mean xyz.com is an existing domain name with a mail server setup that an account 'myname', let alone that user who inputted actually has access to that account. Just send a validation email
  - dfc 14y ago
    You are confusing "valid email address" with "a valid email address, functioning mail server and user with appropriate credentials to access the system that processes email for the supplied email address."
    - randallsquared 14y ago
      What you quoted was "valid user's email address", not "valid email address". While "valid email address" is arguable, a "valid user"'s email address is more clearly about whether it accepts mail. :)

dutchbrit 14y ago

For people validating emails in PHP, use the following code: filter_var($email, FILTER_VALIDATE_EMAIL); The actual beast: https://github.com/php/php-src/blob/master/ext/filter/logical_filters.c#L499 https://github.com/php/php-src/blob/master/ext/filter/logica...

ry0ohki 14y ago
oh wow had no idea that existed, thank you!

jayferd 14y ago

Why do email addresses need comments again?

digitalsushi 14y ago
It helps you remember to whom you gave the address. mikec+farmville@digitalsushi.com is a nice comment that tells me "I used this for farmville; who is now emailing me with it?"
- ben0x539 14y ago
  A malicious sender could just strip out your +whatever, and then you are where you started, unless you already filter all mail without a + part and give all your friends a salted email address.
- eli 14y ago
  No, that's not a comment. That plus sign is part of the email address. It's up to your mail server how to figure out how to parse it and stuff it into the correct inbox. The RFC allows for actual nested comments to appear within the address. Though nobody actually uses this and really the RFC is talking about formatting for email messages in transit, not how you should or shouldn't record your address on a form.
- jimktrains2 14y ago
  I don't think that's what OP meant. You can have comments like first.last(notify IM)@example.com see http://blog.dominicsayers.com/2009/02/27/comments-in-email-addresses/ http://blog.dominicsayers.com/2009/02/27/comments-in-email-a... I just don't understand why they made the spec so complex. Seriously, indefinably nestable comments?

spindritf 14y ago

> Invalid email addresses > Abc.example.com (an @ character must separate the local and domain parts) Well, that also depends on the context because replacing @ with a dot is exactly what you'd do in a zone file: $ dig soa google.com +short ns1.google.com. dns-admin.google.com. 2012113000 7200 1800 1209600 300 So it gets even hairier.

duskwuff 14y ago
Well, yes. But at that point it's no longer an email address.

neya 14y ago

There's a reason why most of those valid email addresses are not allowed by most email providers. As an example, in the 1997-early 2000's, underscores were very popular amongst the internet users and most of them had an underscore in their E-mail addresses. Whilest applying for a job, they would fill out a form in the employer's website/some form application software where the data is then later tabulated. Once tabulated, the entire email address would be underlined by many popular softwares back then, since it's (was) essentially considered as a link. Then, while the recruiters were trying to copy and paste these prospective e-mail ID's in their respective email clients, the underscore would be missed out and would have just a space instead (which the recruiters have no idea as to why) and thus the recipients would miss out from receiving these emails. Hence, many email providers wouldn't allow one to register an underscore (or any complex character) after receiving many such reports, just to avoid these hassles.

alpb 14y ago

Here's what a RFC-compliant email address regex looks like: http://www.ex-parrot.com/~pdw/Mail-RFC822-Address.html http://www.ex-parrot.com/~pdw/Mail-RFC822-Address.html Hint: God damn long.

eli 14y ago

It's weird how often email address validation comes up on HN. I think it must be bike shedding for the web app generation. It's the simplest piece of a common web app for which there could possibly be any discussion or disagreement. Yes, you can have a crazy looking email address. But that doesn't mean you should. And you have no right to expect a web form will let you enter your address with nested comments. On the other hand, a lot of developers seem to confuse validating an email address against the RFC with confirming that it is the user's true and correct address. This is not possible without sending the address a message. Regardless of how good your regex is, it will let many typos through and it will fail to stop "fake@fake.com". I'd suggest spending time elsewhere.

meritt 14y ago
Agreed. When damn near every application today requires the user to click a link sent to their email, I can't envision any reason for actually validating the email at form submission time (except len <= 254). If they click the activation link, it's a legitimate user. End of story.
- dbaupp 14y ago
  And inclusion of @.
- bjt 14y ago
  If you're trying to optimize a registration process, you want to minimize the number of people you lose at each step. If someone gives you a bad email address, and then you try to send the activation link there, you've lost that registration. If you catch it when they submit the form then you've got a better shot at getting a complete registration from that user.
  - fhars 14y ago
    But there are several businesses that tried to do exactly that and lost me as a customer since they didn't accept my perfectly valid address with a + in it.

nofinator 14y ago

Someone should update this McSweeney's list: http://www.mcsweeneys.net/articles/e-mail-addresses-it-would-be-really-annoying-to-give-out-over-the-phone http://www.mcsweeneys.net/articles/e-mail-addresses-it-would...

edmond_dantes 14y ago
A contemporary "Who's on first?" scenario.

unreal37 14y ago

I had no idea that email addresses could be so complex. ""()<>[]:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org" is valid? It won't be a popular view around here, but that SHOULDN'T be valid. The spec needs to change. I won't be making changes to any of the large sites that my company manages to accept weird characters like brackets, semicolons and quotation marks as a valid email address. That's just asking for a XSS or SQL injection attack and other trouble. Sorry, but the spec is just wrong here.

mcguire 14y ago
This is probably not a popular view around here either, but if you're examining the contents of the string to avoid XSS or SQL injection attacks, you're doing it wrong.
mrb 14y ago
You sound like a lazy developer who doesn't want to learn the proper way to protect against XSS and SQL injection. If you have this mentality, your code probably has similar vulnerabilities in pieces of data other than the email address.