Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Validating Email Addresses with Regex (2012)

davidcel.is

Post reply on HN
Print view View original

41–50 of 228 posts

Re: Stop Validating Email Addresses with Regex (2012)

#41

Post by hathawsh »

dchest wrote: post #17

RFCs for email addresses are cool, but on the web we have our own standards! https://html.spec.whatwg.org/multipage/input.html#valid-e-ma... "This requirement is a willful violation of RFC 5322, which defines a syntax for email addresses that is simultaneously too strict (before the "@" character), too vague (after the "@" character), and too lax (allowing comments, whitespace characters, and quoted strings in manner…

I tried using that expression for a while, but then a user with a valid email address containing upper unicode characters showed up. I switched to a simpler expression:

    ^[^@\s\x00-\x1f]+@[^@\s\x00-\x1f.]+(:?\.[^@\s\x00-\x1f.]+)*$
It requires exactly one "@", disallows whitespace and control characters, prevents repeated dots in the domain name, and ensures the domain doesn't end with a dot. It catches a few typos and I think it allows every real email address I've heard of.

Re: Stop Validating Email Addresses with Regex (2012)

#42

Post by programmarchy »

User23 wrote: post #28

Ah, an old classic. Here[1] for example is a simple RFC 822 compliant email address recognizing regex: (?:(?:\r\n)?[ \t])*(?:(?:(?:[^() @,;:\\".\[\] \000-\031]+(?:(?:(?:\r\n)?[ \t] )+|\Z|(?=[\["() @,;:\\".\[\]]))|"(?:[^\"\r\\]|\\.|(?:(?:\r\n)?[ \t]))*"(?:(?: \r\n)?[ \t])*)(?:\.(?:(?:\r\n)?[ \t])*(?:[^() @,;:\\".\[\] \000-\031]+(?:(?:( ?:\r\n)?[ \t])+|\Z|(?=[\["() @,;:\\".\[\]]))|"(?:[^\"\r\\]|\\.|(?:(?:\r\n)?[ \t]))*…

LGTM!

Re: Stop Validating Email Addresses with Regex (2012)

#43

Post by samwillis »

usrbinbash wrote: post #3

Can't upvote this enough. There simply is no need to check the email addr provided by the user. Send the mail, if it bounces, the user has only himself to blame. What if I don't want them to go through the hassle of an activation link? Then I don't bother with an email account in the sign-up process in the first place. If they want a passwd reset method, they can later provide an email in their settings page, if that…

I can assure you that this would end up with far more problems than it will solve.

I run an online store, people miss entering their email address is one of the largest causes of customers contacting support, and they regularly jump to being angry accusing us of being incompetent or worse.

I would take the 0.001% of people who may have an email incompatible with a regex being frustrated (which will happen to them all the time) over the 10% who screw up entering their address.

We even have code that looks for common typos and prompt the users to double check them. Somehow they still make those mistakes.

Re: Stop Validating Email Addresses with Regex (2012)

#44

Post by omegalulw »

dchest wrote: post #17

RFCs for email addresses are cool, but on the web we have our own standards! https://html.spec.whatwg.org/multipage/input.html#valid-e-ma... "This requirement is a willful violation of RFC 5322, which defines a syntax for email addresses that is simultaneously too strict (before the "@" character), too vague (after the "@" character), and too lax (allowing comments, whitespace characters, and quoted strings in manner…

What is the significance of [a-zA-Z0-9-]{0,61}? Some special limit on 61 characters?

Re: Stop Validating Email Addresses with Regex (2012)

#45

Post by kingcharles »

eric4smith wrote: post #33

You actually should at least use regex to check some basic things. Like "@" "." or even just disallowed characters. As someone who sends a LOT of email for customers every week, a big percentage of our problem is incorrectly formatted emails. So we just don't even let them in these days. People are forgetting that for services that have to send email it costs dearly to bounce. Bounces decrease the quality of your lis…

Please don't check for a full-stop/period. It excludes those who have their email address directly on a TLD.

Re: Stop Validating Email Addresses with Regex (2012)

#47

Post by easrng »

hathawsh wrote: post #41
dchest wrote: post #17

RFCs for email addresses are cool, but on the web we have our own standards! https://html.spec.whatwg.org/multipage/input.html#valid-e-ma... "This requirement is a willful violation of RFC 5322, which defines a syntax for email addresses that is simultaneously too strict (before the "@" character), too vague (after the "@" character), and too lax (allowing comments, whitespace characters, and quoted strings in manner…

I tried using that expression for a while, but then a user with a valid email address containing upper unicode characters showed up. I switched to a simpler expression: ^[^@\s\x00-\x1f]+@[^@\s\x00-\x1f.]+(:?\.[^@\s\x00-\x1f.]+)*$ It requires exactly one "@", disallows whitespace and control characters, prevents repeated dots in the domain name, and ensures the domain doesn't end with a dot. It catches a few typos and…

Domains ending with a dot are valid though, and it's needed sometimes. For example, someone@ai. (ai. is a TLD) is a different email than someone@ai (ai is a local hostname)

Re: Stop Validating Email Addresses with Regex (2012)

#48

Post by sverhagen »

eric4smith wrote: post #33

You actually should at least use regex to check some basic things. Like "@" "." or even just disallowed characters. As someone who sends a LOT of email for customers every week, a big percentage of our problem is incorrectly formatted emails. So we just don't even let them in these days. People are forgetting that for services that have to send email it costs dearly to bounce. Bounces decrease the quality of your lis…

I think the case you are really making is for using the string validation (regex) to knock out clear or even obvious mistakes, as opposed to using a regex that everyone has to pass to proceed.

Re: Stop Validating Email Addresses with Regex (2012)

#49

Post by hathawsh »

easrng wrote: post #47
hathawsh wrote: post #41

Earlier quoted context omitted.

I tried using that expression for a while, but then a user with a valid email address containing upper unicode characters showed up. I switched to a simpler expression: ^[^@\s\x00-\x1f]+@[^@\s\x00-\x1f.]+(:?\.[^@\s\x00-\x1f.]+)*$ It requires exactly one "@", disallows whitespace and control characters, prevents repeated dots in the domain name, and ensures the domain doesn't end with a dot. It catches a few typos and…

Domains ending with a dot are valid though, and it's needed sometimes. For example, someone@ai. (ai. is a TLD) is a different email than someone@ai (ai is a local hostname)

Good to know. I guess I'll simplify again. Besides, I wonder whether the expression is vulnerable to catastrophic backtracking.

Re: Stop Validating Email Addresses with Regex (2012)

#50

Post by sverhagen »

kingcharles wrote: post #45
eric4smith wrote: post #33

You actually should at least use regex to check some basic things. Like "@" "." or even just disallowed characters. As someone who sends a LOT of email for customers every week, a big percentage of our problem is incorrectly formatted emails. So we just don't even let them in these days. People are forgetting that for services that have to send email it costs dearly to bounce. Bounces decrease the quality of your lis…

Please don't check for a full-stop/period. It excludes those who have their email address directly on a TLD.

Is that an existing cohort? I'm not saying it isn't, I've just not run across them.
Post reply on HN