Stop Validating Email Addresses With Your Complex Regex • Hacker News Board

Re: Stop Validating Email Addresses With Your Complex Regex

#81

Post by epochwolf » Fri, May 24, 2013, 4:23 PM UTC

anonyfuss wrote: post #56

wodow wrote: post #30

Earlier quoted context omitted.

I understand the argument re validating email addresses passively (regex, no regex, etc.) vs actively (send an email by SMTP). What I don't understand with this ever-repeating discussion is why the complexity has to be visible. e.g. > > Yeesh. Is something that complex really necessary? Many functions are complex - we put those in libraries, pushing them under the hood, and move on. What is so special about parsing e…

> What is so special about parsing email addresses that makes everyone invent their own solution - regex or otherwise? A valid email address can contain almost anything; this makes validation via a standard parser mostly useless. As such, devlopers reach for stricter parsers out of a combination of a not comprehending the standards, feeling vague discomfort about letting 'just anything' past data validation, and misp…

> misplaced concern for users that they believe can't type their own e-mail address

How is this misplaced? People screw up even the most basic of computer tasks all the time.

Re: Stop Validating Email Addresses With Your Complex Regex

#82

Post by 5teev » Fri, May 24, 2013, 4:25 PM UTC

It's an interesting intellectual exercise to build THE email validation regex, but it's shortsighted to inflict your experiment on the public.

While I definitely enjoyed how Friedl's book (http://regex.info/book.html) builds over several chapters to an ever more complex solution, maybe a page long, my takeaway was: don't bother. A friendly UI will help users avoid an obvious mistake, but as other posters have pointed out, the only real validation is, does an email get there?

Re: Stop Validating Email Addresses With Your Complex Regex

#83

Post by eli » Fri, May 24, 2013, 4:25 PM UTC

onemorepassword wrote: post #15

This has been an issue since the day I started programming for the web, back somewhere in '95. It has regularly come up on HN, and pretty much any programming related forum I've used since the mid-90's. As an industry at the heart of the information society you have to wonder what the hell we are doing wrong if we cannot stop this constant regression into well known bad practices.

I think it's mostly just bikeshedding. This is a problem that is both largely unimportant but also common enough that many have encountered it (and thus have an opinion).

Re: Stop Validating Email Addresses With Your Complex Regex

#84

Post by raawlls » Fri, May 24, 2013, 4:25 PM UTC

How about this: Add a mailto link that sets the subject to some type of token, they click the link, hit send, app catches the email, sets the correct address accordingly.

Re: Stop Validating Email Addresses With Your Complex Regex

#85

Post by ben0x539 » Fri, May 24, 2013, 4:26 PM UTC

twistedpair wrote: post #47

Amen! Anyone else here use myemail+token@gmail.com when they have to register with their email to find out who is selling them out and to make spam filters easier? It still amazes me that 70% of the places I attempt using foo+bar@gmail.com call it invalid. And that does not even begin to touch the myriad valid permutations that are "invalid" out there.

Maybe they're on to you and only pretend that they think it's invalid so you'll give them a slightly-less-throwaway address ;)

Re: Stop Validating Email Addresses With Your Complex Regex

#86

Post by davidcelis » Fri, May 24, 2013, 4:27 PM UTC

baby wrote: post #32

In PHP you have default functions that can verify emails : filter_var('bob@example.com', FILTER_VALIDATE_EMAIL) more info here : http://php.net/manual/en/function.filter-var.php

And that uses a giant regex.

Re: Stop Validating Email Addresses With Your Complex Regex

#87

Post by vpeters25 » Fri, May 24, 2013, 4:29 PM UTC

I would like to make a plea to anybody coding email verifications to please include the ip address of the request, this way we get a sort of warning somebody is trying to impersonate us.

Re: Stop Validating Email Addresses With Your Complex Regex

#88

Post by therealunreal » Fri, May 24, 2013, 4:33 PM UTC

fein wrote: post #25

MichaelApproved wrote: post #19

Earlier quoted context omitted.

I thought new TLD being worked on didn't need to have dots in them. Why not just check for x@x?

That's exactly what you should do. ^(.+)@(.+)$ max length is 254 according to the RFC I believe, so you can check for that too.

IIRC, last I checked max length was 320.

Re: Stop Validating Email Addresses With Your Complex Regex

#89

Post by claudius » Fri, May 24, 2013, 4:35 PM UTC

saucetenuto wrote: post #40

Yeah, and then you wind up sending mail to "joe@hotmailcom" or "liz@gmailc.om", and your users don't get your messages and are sad. Don't validate the local part, do validate the domain.

Especially since this is extremely easy to do, it’s just three DNS queries away (plus one in case of CNAMEs).

Re: Stop Validating Email Addresses With Your Complex Regex

#90

Post by nostromo » Fri, May 24, 2013, 4:35 PM UTC

I don't think this is good advice.

From a previous startup we saw a ton of signups like, "john@gmail" and the like. Obviously this person will not get a validation email -- and in all likelihood will not be able to log in to his account when he returns. It's best to catch him when he's entering the information.