2 ms·
I had no idea that email addresses could be so complex. ""()<>[]:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org" is valid? It won't be a popular view aro
by unreal37 14y ago
I had no idea that email addresses could be so complex. ""()<>[]:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org" is valid?
It won't be a popular view around here, but that SHOULDN'T be valid. The spec needs to change. I won't be making changes to any of the large sites that my company manages to accept weird characters like brackets, semicolons and quotation marks as a valid email address. That's just asking for a XSS or SQL injection attack and other trouble.
Sorry, but the spec is just wrong here.
- mcguire 14y agoThis is probably not a popular view around here either, but if you're examining the contents of the string to avoid XSS or SQL injection attacks, you're doing it wrong.
- mrb 14y agoYou sound like a lazy developer who doesn't want to learn the proper way to protect against XSS and SQL injection. If you have this mentality, your code probably has similar vulnerabilities in pieces of data other than the email address.