Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Validating Email Addresses with Regex (2012)

davidcel.is

Post reply on HN
Print view View original

121–130 of 228 posts

Re: Stop Validating Email Addresses with Regex (2012)

#121

Post by lkbm »

kube-system wrote: post #100
remram wrote: post #96

Earlier quoted context omitted.

You will want to check ownership by sending a verification email anyway. If you want to avoid typos, show a "are you sure... yes/no" warning, there is no need to block anybody. Typos will overwhelmingly lead to valid-looking addresses anyway.

I usually just validate that there’s an “@” character. It prevents the most obvious typos like a blank field, or information entered in the wrong field. You’re right that you can’t prevent someone from typing their address incorrectly, but you can make sure they didn’t put in their phone number or their first name by mistake

Mailgun has an API endpoint that works pretty well. If you enter "foo@gnail.con", it suggests "foo@gmail.com".

It's overkill for an HN registration form, where if I type my email wrong, I can just re-register, but for checkout forms it can be worth putting in a little extra validation.

Re: Stop Validating Email Addresses with Regex (2012)

#122

Post by lkbm »

stavros wrote: post #106

I gave a very fun talk on the topic in FOSDEM (VOLUME WARNING!): https://www.youtube.com/watch?v=xxX81WmXjPg It's more a joke than edifying, but it was very fun for me (and, I think, the audience), and illustrates the difficulty of email validation well.

I've always loved the "Email Hates The Living" talk[0] and am sad it's not available in higher quality. This is a great alternative.

[0] https://www.youtube.com/watch?v=4s9IjkMAmns

Re: Stop Validating Email Addresses with Regex (2012)

#124

Post by charles_f »

The only way to validate an email is to send a message to the email address. Validating that it fits the rfc is pointless, because a) its very easy to create an email that is both false and meets the rfc, b) email provider might bypass the rfc and the email would still be working.

To validate user input, I use that: /^[^@]+@[^.]+\..+$/. It's doesn't tell me if the email is semantically correct per the rfc because I'm not running an rfc correctness validation service. What I want is to make sure that users didn't input their name in the email field. This tells me if it ressembles an email

Re: Stop Validating Email Addresses with Regex (2012)

#125

Post by leros »

usrbinbash wrote: post #3

Can't upvote this enough. There simply is no need to check the email addr provided by the user. Send the mail, if it bounces, the user has only himself to blame. What if I don't want them to go through the hassle of an activation link? Then I don't bother with an email account in the sign-up process in the first place. If they want a passwd reset method, they can later provide an email in their settings page, if that…

I would like to agree, but sending an email that bounces will negatively impact your email reputation and thus your deliverability.

I work at a large web company. We ran a test around removing email validation and we had about 20% of users typo their emails when signing up. Simple things like not putting the period before com like "john@gmailcom". It resulted in customers basically creating accounts they couldn't get back to which was a bad user experience and loss of revenue for us.

Based on our testing, email validation mostly served to prevent these basic typos.

Re: Stop Validating Email Addresses with Regex (2012)

#126

Post by jmbwell »

I think the point of the article is that this seems like it would be an easy problem to solve, but it is not.

Lots of commenters insisting that they need to validate somehow. If you have a need to validate, use a good email validation library. Better consistency throughout your app, and someone else has figured out the hardest stuff.

Stop validating emails. But if you can’t stop, at least stop rolling your own regex on the fly to do it. Use a good library instead.

Re: Stop Validating Email Addresses with Regex (2012)

#128

Post by [deleted] »

electroly wrote: post #116
qwerty456127 wrote: post #111

Earlier quoted context omitted.

> containing upper unicode characters Are e-mail addresses case-sensitive? I would always lowercase&trim a string meant to represent an e-mail address (or a domain name) before doing anything else with it.

The local-part before the @ can be case-sensitive, yes. I've never heard of a mail server that treats it as such, but the RFC says it's case sensitive.

[deleted]

Re: Stop Validating Email Addresses with Regex (2012)

#130

Post by rrdharan »

kingcharles wrote: post #52

PLEASE, FOR THE LOVE OF GOD, can all of you who write email validation not include a whitelist of TLDs that you allow. THIS IS KILLING ME. My primary email addresses are on two TLDs, one of which has been around for 24 years, the other for seven years, but about 10% of sites I try to register on refuse to accept them, saying that they are not valid. They clearly have not updated some internal whitelist since these TL…

Obviously, they aren’t going to stop. Why wouldn’t you just give up and get another email address and set up forwarding? Life is too short to yell at clouds all day.
Post reply on HN