> Input validation is usually a UX fail I agree in general. I think it was just a contrived example though in interest of discussing security/validation. Their

> Input validation is usually a UX fail I agree in general. I think it was just a contrived example though in interest of discussing security/validation. Their example was in context of US users (and US zip-codes don't deviate from the pattern, but yes you could go one step further and reference the zip-code against the state and address using an API). Also, specifically on regex, I'd imagine \d is being used in places where validation against unicode would be buggy (whether in form validation or elsewhere). I think Java and JavaScript default to ASCII only though.