Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Validating Email Addresses with Regex (2012)

davidcel.is

Post reply on HN
Print view View original

51–60 of 228 posts

Re: Stop Validating Email Addresses with Regex (2012)

#51

Post by easrng »

kingcharles wrote: post #45
eric4smith wrote: post #33

You actually should at least use regex to check some basic things. Like "@" "." or even just disallowed characters. As someone who sends a LOT of email for customers every week, a big percentage of our problem is incorrectly formatted emails. So we just don't even let them in these days. People are forgetting that for services that have to send email it costs dearly to bounce. Bounces decrease the quality of your lis…

Please don't check for a full-stop/period. It excludes those who have their email address directly on a TLD.

No it doesn't. Those require a dot at the end. Without a dot, it's a hostname not a TLD.

Re: Stop Validating Email Addresses with Regex (2012)

#52

Post by kingcharles »

PLEASE, FOR THE LOVE OF GOD, can all of you who write email validation not include a whitelist of TLDs that you allow. THIS IS KILLING ME.

My primary email addresses are on two TLDs, one of which has been around for 24 years, the other for seven years, but about 10% of sites I try to register on refuse to accept them, saying that they are not valid. They clearly have not updated some internal whitelist since these TLDs were added.

I just had one major ecommerce go into their DB and update my address. This was a bad idea because now my profile page has an error and I can't change anything else.

STOP THIS. JUST STOP.

Re: Stop Validating Email Addresses with Regex (2012)

#53

Post by goto11 »

coolhoody wrote: post #35

This won't be popular, but: 1. An experienced dev just killed 54k stars on GitHub due to pressing a button in an auto-pilot mode. Do you think a Joe High who wants to give you $100 won't ever type '2' instead of '@'? What about an old lady? Or someone with physical difficulties? Have you personally ever made a typo in an email? 2. That code in the article is not color highlighted (rainbowed for Regex) or formatted pr…

Sure, but the most common typos would just result in a wrong address which is still syntactically valid. That is why the address should be verified by sending an actual mail for important stuff. This is also the only way to protect against fake addresses, since anyone can come up with a fake address which is still syntactically valid.

I do like to check for '@' to enure the user have not entered their name or something by mistake, but beyond that the syntactic validation does not provide any value.

Re: Stop Validating Email Addresses with Regex (2012)

#54

Post by easrng »

sverhagen wrote: post #50
kingcharles wrote: post #45

Earlier quoted context omitted.

Please don't check for a full-stop/period. It excludes those who have their email address directly on a TLD.

Is that an existing cohort? I'm not saying it isn't, I've just not run across them.

Probably not. http://ai./ has a website, but no emails AFAIK

Re: Stop Validating Email Addresses with Regex (2012)

#55

Post by xurukefi »

What's even worse is that a lot of people think that it is a great idea to check the TLD against the set of existing TLDs. Of course, nobody gets such a whitelist right or cares to update it if new TLDs are created. From experience I can say that having an e-mail address with a not so popular and rather new gTLD is an absolute nightmare. We had to roll out aliases with "normal" TLDs to combat this.

Re: Stop Validating Email Addresses with Regex (2012)

#57

Post by samwillis »

This is a very bad idea, it will make your customers and support team unhappy.

It’s is one of those “technically” vs “practicality” things, not using a regex will cause you more customer support problems than solve.

I run an online store, typoed email addresses are one of the top causes of customers contacting support. In 10 years we have never had a customer contact us to complain their “valid” email address won’t be excepted on our site. If we were to remove the regex from the validation and “just try to send an email” as suggested it would create so much more work for our support team.

You should also implement some “soft” validation looking for common typos, although people still somehow make those mistakes. I’m convinced that some people have types in their autocomplete address book.

Re: Stop Validating Email Addresses with Regex (2012)

#58

Post by wolrah »

gleenn wrote: post #7

One of the best validation techniques I heard was check for an "@" symbol and if they have one the call it good.

Most internet systems can also assume there will be at least one dot following the @ symbol and at least two characters after that. Something intended for us on internal domains of course can't many assumptions.

Re: Stop Validating Email Addresses with Regex (2012)

#59

Post by kazinator »

usrbinbash wrote: post #3

Can't upvote this enough. There simply is no need to check the email addr provided by the user. Send the mail, if it bounces, the user has only himself to blame. What if I don't want them to go through the hassle of an activation link? Then I don't bother with an email account in the sign-up process in the first place. If they want a passwd reset method, they can later provide an email in their settings page, if that…

What's much more important than validating the syntax of the e-mail is not to let your service be turned into a relay for targeting e-mail addresses of third parties with "backscatter".

Don't put up a web page where any visitor can put in an e-mail address, to which you send something, without any safeguards: like not sending to the same e-mail address more than just several times in a 24 hour period or something.

Have Captches or or something to reduce the bots. Proof of work. Whatever.

It may be wise to validate not for valid e-mail address syntax, but for certain invalid e-mail addresses to which you shouldn't send.

For instance, would any legitimate user be subscribing with an e-mail address of postmaster@example.com? It seems it would be worth it to have a database of patterns of at least some well known mailing list addresses. Certain domains are almost certainly mailing lists; e.g. anything@vger.kernel.org is probably a list; don't send to it.

Process bounces.

Re: Stop Validating Email Addresses with Regex (2012)

#60

Post by sverhagen »

coolhoody wrote: post #35

This won't be popular, but: 1. An experienced dev just killed 54k stars on GitHub due to pressing a button in an auto-pilot mode. Do you think a Joe High who wants to give you $100 won't ever type '2' instead of '@'? What about an old lady? Or someone with physical difficulties? Have you personally ever made a typo in an email? 2. That code in the article is not color highlighted (rainbowed for Regex) or formatted pr…

Agreed. And while I wouldn't attempt creating a regex for email addresses -- if I really felt I needed that, I think that's what libraries are for, not my job -- I have used plenty of regexes in useful and successful ways. I wanted to really add to your "you won't need to edit it for 20 years" comment that the regex should also be anchored with a unit test, that demonstrates the usages you designed for (and maybe a few negative tests to show what you specifically didn't intend to solve).
Post reply on HN