>I know hacking LinkedIn just to make a point about email validation is a bit extreme, but it is important to back up one’s opinions with data
Hardcore.
The Correct Way to Validate Email Addresses
31–40 of 405 posts
Re: The Correct Way to Validate Email Addresses
#32Why not go the other way and compute the edit distance to commonly used domain names, and then prompt the user and ask if it's correct?
E.g. if I type foo@googl.com, it should be pretty likely that I meant google.com.
Re: The Correct Way to Validate Email Addresses
#33Hmm, sorry but I don't buy that the "correct way to validate" is not to validate the input. Email addresses aren't a special enough case to be handled differently than any other user input, which we always validate to both sanitize and show client-side errors, if nothing else. Sure, the complete regex is complex, but it is defined and is hardly unconquerable. Look at Django's `EmailValidator` implementation for examp…
You can use a regex as a simple pre-check but you absolutely have to do more than that if you expect high-quality results. Back in the 90s, we ran the customer rewards program mailing list for a mainstream business you've heard of. A [gnarly] regex took care of the gross failures but we still had double-digit percentage of invalid addresses and many spam reports because people mistyped their username, used their old…
Definitely, I think email validation links are important too. However, it's pretty senseless to let an obviously invalid email address pass all the way through to that layer (and potentially get billed for sending messages to invalid email addresses).
Re: The Correct Way to Validate Email Addresses
#34The number of websites that try reject my email address with a + in it, ugh! Surprisingly, the validation is often done 100% client-side anyway, and simply modifying the incorrect regex lets my email address through... If I wrecked havoc on your back-end, then it's your fault for sucking ;)
Worse than that: I've encountered a few web sites which accept email addresses with '+' characters... and then tell me that my email address has a ' ' character in it. Every time I see this I think "there's got to be a multiple-form-decoding vulnerability here"...
Re: The Correct Way to Validate Email Addresses
#35The number of websites that try reject my email address with a + in it, ugh! Surprisingly, the validation is often done 100% client-side anyway, and simply modifying the incorrect regex lets my email address through... If I wrecked havoc on your back-end, then it's your fault for sucking ;)
Even worse is rejecting my password because it has a + in it! Why do you as a business care what my random password generator spit out??
Scarier still is when it's a server-side response that rejects my password for its contents...
Re: The Correct Way to Validate Email Addresses
#36Yes, please do send activation emails (or perhaps a personal confirmation email if you are establishing contact with someone that wrote down an address for you). Those of us with firstnamelastname@commonhost will appreciate not getting bills and job offers and such.
I've been getting monthly status reports from some guy's Hyundai for months... The unsubscribe link does nothing... I'm tempted to reset his password and change the email address.
Re: The Correct Way to Validate Email Addresses
#37Hmm, sorry but I don't buy that the "correct way to validate" is not to validate the input. Email addresses aren't a special enough case to be handled differently than any other user input, which we always validate to both sanitize and show client-side errors, if nothing else. Sure, the complete regex is complex, but it is defined and is hardly unconquerable. Look at Django's `EmailValidator` implementation for examp…
> Sure, the complete regex is complex, but it is defined and is hardly unconquerable.
If it is a regular expression, then it is not able to match all valid email addresses, because the grammar of email addresses is context-free, and regular expressions can only match regular grammars. It doesn't matter if it is defined or not: if it's a true regular expression, then it simply cannot validate email addresses.
(it may, of course, be a context-free expression masquerading as a regular expression)
I wonder if the django validator will choke on perfectly valid email addresses such as (this)"()[]:,;@\\\"!#$%&'-/=?^_`{}| ~.a"(is)@(valid)example.org(honest)
I suspect that it will, but of course I could be wrong.
Re: The Correct Way to Validate Email Addresses
#38The number of websites that try reject my email address with a + in it, ugh! Surprisingly, the validation is often done 100% client-side anyway, and simply modifying the incorrect regex lets my email address through... If I wrecked havoc on your back-end, then it's your fault for sucking ;)
Even worse is rejecting my password because it has a + in it! Why do you as a business care what my random password generator spit out?? Scarier still is when it's a server-side response that rejects my password for its contents...
scarier still is when they let you set it but fail to let you log in (generally happens more with length). i don't know what you're doing, but i know it's not right and it scares the hell out of me
Re: The Correct Way to Validate Email Addresses
#39I do a lot of optin email. Here are some examples of bounced emails that people use to sign up: * somename@gmail.co * anothername@yhoo.com * myemail@hotmial.com These are very common errors that occur nearly every day. A regex isn't going to help here. What does help, is a notification that asks people to verify what they typed –– if the email contains an obvious, common error, such as one listed above.
Asking to retype though being a simple solution IMHO is asking for a lot. Consider a user who uses mobile phone, even copy paste is annoying. Validating if the mail box exists and that it does not belong to a provider like mailinator and then sending a confirmation link to them works. While its not perfect, it does address lot of other concerns without sacrificing user experience.
Also, asking to retype makes sense for a password where you can't visually verify that you typed what you expected. For an email address, it's pointless and frustrating. Send an email. If it bounces or doesn't get verified in a timely fashion, it was a mistake and delete the account.
Re: The Correct Way to Validate Email Addresses
#40I have a .link domain for my personal email and a lot of sites refuse to let me register because they don't recognize it as a valid TLD.
Then there's the textbook company that lets me register but refuses to let me reset my password claiming that I'm trying to enter an "invalid email address."