Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Validating Email Addresses With Your Complex Regex

davidcel.is

Post reply on HN
Print view View original

161–170 of 211 posts

Re: Stop Validating Email Addresses With Your Complex Regex

#161

Post by baudehlo »

ljd wrote: post #113
nostromo wrote: post #90

I don't think this is good advice. From a previous startup we saw a ton of signups like, "john@gmail" and the like. Obviously this person will not get a validation email -- and in all likelihood will not be able to log in to his account when he returns. It's best to catch him when he's entering the information.

I hear and understand a lot of the comments on this thread mention that regex saves the user from a typo and such. So I want to vouch for a github project called mailcheck[0] by the Kicksend team that's great. At Ventata, we used to have the same issues you've all described with people forgetting things like ".com" and "gmial" vs "gmail". Once we started using mailcheck our bounce rate went way down. Now we only get…

The only thing mailcheck doesn't do is check if the domain has MX records, so valid looking domains that you'll never be able to send anything to will pass.

I've tried to help this situation by creating an API for you guys: https://www.emailitin.com/email_validator

Re: Stop Validating Email Addresses With Your Complex Regex

#162

Post by kstrauser »

FireBeyond wrote: post #98
twistedpair wrote: post #47

Amen! Anyone else here use myemail+token@gmail.com when they have to register with their email to find out who is selling them out and to make spam filters easier? It still amazes me that 70% of the places I attempt using foo+bar@gmail.com call it invalid. And that does not even begin to touch the myriad valid permutations that are "invalid" out there.

And likewise, it amazes me that people think that for all their efforts at combating filters, captchas and the like, that the most nefarious of spammers aren't stripping off "+token"s from email addresses.

Spammers tend to be stupid. When I post my email address as "me+tag@mydomain.com" on a certain popular, well-scraped website, I see lots of rejected traffic to "tag@mydomain.com".

Re: Stop Validating Email Addresses With Your Complex Regex

#163

Post by baudehlo »

anonyfuss wrote: post #115
epochwolf wrote: post #81

Earlier quoted context omitted.

> misplaced concern for users that they believe can't type their own e-mail address How is this misplaced? People screw up even the most basic of computer tasks all the time.

1) Because the solutions actually prevent some users from typing their actual e-mail address. 2) There are so many ways to get the e-mail address wrong that it's almost not worth bothering validating the few things that you can validate. Now, here's what would be an interesting validation method that doesn't actually require sending an e-mail. It requires an RFC-compliant e-mail parser, not a regexp: - Perform A/MX l…

Hopefully that's not the SMTP syntax you're actually using.

    * There's no space between FROM: and the address in SMTP
    * Email addresses must come between angle brackets
I'd reject (give you a 5xx) that from my mail server for those reasons alone.

Re: Stop Validating Email Addresses With Your Complex Regex

#164

Post by davidw »

anonyfuss wrote: post #140
tomjen3 wrote: post #138

Earlier quoted context omitted.

Honestly if the user is signing up with an ip email then you really shouldn't accept it - it may be valid but something fishy is going on for sure.

Why does it matter? If I managed to acquire the 8.8.8.0/24 netblock, I might very well want to use 'user@8.8.8.8' as my e-mail address. I don't see why it has any material affect on someone requesting e-mail addresses: if it's valid, then it's valid. This seems to be an example of the misplaced sense of propriety with which people approach validating e-mail addresses -- that somehow, your job isn't just to help the u…

The one user in 10,000 who actually uses an ip address as an email address can surely figure out why they're getting rejected. Of course, he'll probably go channel the Comic Book Guy and write a scathing post on his blog (Worst. Regexp. Ever.), but the normal people who use the service probably won't see that anyway.

Re: Stop Validating Email Addresses With Your Complex Regex

#165

Post by anonyfuss »

davidw wrote: post #164
anonyfuss wrote: post #140

Earlier quoted context omitted.

Why does it matter? If I managed to acquire the 8.8.8.0/24 netblock, I might very well want to use 'user@8.8.8.8' as my e-mail address. I don't see why it has any material affect on someone requesting e-mail addresses: if it's valid, then it's valid. This seems to be an example of the misplaced sense of propriety with which people approach validating e-mail addresses -- that somehow, your job isn't just to help the u…

The one user in 10,000 who actually uses an ip address as an email address can surely figure out why they're getting rejected. Of course, he'll probably go channel the Comic Book Guy and write a scathing post on his blog (Worst. Regexp. Ever.), but the normal people who use the service probably won't see that anyway.

Again, what material difference does it make to you?

Overzealously rejecting valid addresses is an application of subjective and inaccurate ideas about what addresses 'should' look like, and ignores the simple fact we've already mutually and formally defined valid address formats via the IETF RFCs.

Re: Stop Validating Email Addresses With Your Complex Regex

#166

Post by marcosdumay »

MattBearman wrote: post #31
MichaelApproved wrote: post #19

Earlier quoted context omitted.

I thought new TLD being worked on didn't need to have dots in them. Why not just check for x@x?

As far as I know the new tlds will still have a dot between tld and actual domain (I could be wrong though) but it's just been pointed out that IPv6 emails addresses could fail on my regex. The reason I don't currently use x@y is just to have a better shot at catching typos without being too restrictive.

There is no requirement for any other level in a domain, except for the TLD.

Re: Stop Validating Email Addresses With Your Complex Regex

#167

Post by lucb1e »

davidcelis wrote: post #86
baby wrote: post #32

In PHP you have default functions that can verify emails : filter_var('bob@example.com', FILTER_VALIDATE_EMAIL) more info here : http://php.net/manual/en/function.filter-var.php

And that uses a giant regex.

At least it's a standardized way of doing it. If it turns out to contain an error, it can be fixed for all websites with an update.

Re: Stop Validating Email Addresses With Your Complex Regex

#168

Post by anonyfuss »

baudehlo wrote: post #163
anonyfuss wrote: post #115

Earlier quoted context omitted.

1) Because the solutions actually prevent some users from typing their actual e-mail address. 2) There are so many ways to get the e-mail address wrong that it's almost not worth bothering validating the few things that you can validate. Now, here's what would be an interesting validation method that doesn't actually require sending an e-mail. It requires an RFC-compliant e-mail parser, not a regexp: - Perform A/MX l…

Hopefully that's not the SMTP syntax you're actually using. * There's no space between FROM: and the address in SMTP * Email addresses must come between angle brackets I'd reject (give you a 5xx) that from my mail server for those reasons alone.

> Hopefully that's not the SMTP syntax you're actually using.

I typed it out live. I'm not an SMTP client and I don't have the RFCs memorized.

> I'd reject (give you a 5xx) that from my mail server for those reasons alone.

Postfix accepts it. I haven't checked the RFC to verify your concerns, but assuming they're correct, then my expectation is that postfix is liberal in what it accepts because A) it's a good idea, and B) a real mail transfer agent probably ignored those two minimal rules at some point in the past.

Re: Stop Validating Email Addresses With Your Complex Regex

#170

Post by davidw »

anonyfuss wrote: post #165
davidw wrote: post #164

Earlier quoted context omitted.

The one user in 10,000 who actually uses an ip address as an email address can surely figure out why they're getting rejected. Of course, he'll probably go channel the Comic Book Guy and write a scathing post on his blog (Worst. Regexp. Ever.), but the normal people who use the service probably won't see that anyway.

Again, what material difference does it make to you? Overzealously rejecting valid addresses is an application of subjective and inaccurate ideas about what addresses 'should' look like, and ignores the simple fact we've already mutually and formally defined valid address formats via the IETF RFCs.

> Again, why does this matter to you, other than some sort of misplaced sense of authoritarian aesthetics?

Yes! Great Comic Book Guy impression.

Why it matters is that for most smallish companies, you want to get something up that helps your users not do stupid stuff (†), but due to time and resource constraints, you're likely to end up with some kind of 80/20 solution. It'll work well in most cases, and fall down in some others. I would certainly agree with the idea that you not force people, but a nudge is probably going to save you money in increased user retention and fewer support hassles.

† - I once had a person ask why their emails to http://example.com were failing.

Post reply on HN