Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Validating Email Addresses With Your Complex Regex

davidcel.is

Post reply on HN
Print view View original

201–210 of 211 posts

Re: Stop Validating Email Addresses With Your Complex Regex

#201

Post by invisible »

mkehrt wrote: post #186
invisible wrote: post #128

Earlier quoted context omitted.

I love these articles that are posted and the ACCURATE answer is that the article proposes bad advice. In what world is not validating an email a good thing? It's not like emails vary after a certain complexity is reached. A better article would have been someone documenting a validation regex that approaches perfect without exceeding insane complexity. Next we'll see articles to not run the Luhn algorithm on credit…

I regularly run into email fields that won't accept +. This is just an extension of that thinking.

Then that is a very poor validation attempt. Sidestepping things that have been programmed poorly in the past doesn't make for good programming practices.

Re: Stop Validating Email Addresses With Your Complex Regex

#202

Post by invisible »

DanBC wrote: post #172
invisible wrote: post #128

Earlier quoted context omitted.

I love these articles that are posted and the ACCURATE answer is that the article proposes bad advice. In what world is not validating an email a good thing? It's not like emails vary after a certain complexity is reached. A better article would have been someone documenting a validation regex that approaches perfect without exceeding insane complexity. Next we'll see articles to not run the Luhn algorithm on credit…

> In what world is not validating an email a good thing? Validating an email address is important. The way you do that is send an email to that address. You can't do it with regex, and attempting to do so leaves you open to a variety of flaws.

That is not validating - that is accepting it blindly into your database. You potentially just lost a user and/or customer (or made them unhappy because now they have to register again).

Like I said, when you accept a credit card, normally you validate the formatting of the card before trying to charge money using the info. Emails are very similar.

Re: Stop Validating Email Addresses With Your Complex Regex

#203

Post by anonyfuss »

baudehlo wrote: post #197
anonyfuss wrote: post #194

Earlier quoted context omitted.

At which point the legit sender does what -- replace their MtA? More likely they just contact thir receipient out-of-band (eg; gmail) and avoid your over-zealous mta. Whether you think you're 'Throwing away' is just semantics. From a user's perspective that's exactly what you're doing.

It's my MTA, I'm the "user". My server, my rules. Just like if you want to come into my house you come in the front door and take your shoes off, not crash through the window in muddy boots.

In that case, I wouldn't say it's a particularly useful anecdote for anyone else.

Re: Stop Validating Email Addresses With Your Complex Regex

#204

Post by hrktb »

smackfu wrote: post #175
hrktb wrote: post #146

Earlier quoted context omitted.

That's roughly 40 chars ? People coming from some regions easily have 20 to 30 chars for the family name alone [1]. That's more or less the length of our test string if the add the given name(s). [1] http://news.bbc.co.uk/2/hi/africa/5651310.stm

I think the point is that they are using all capital W's which are the widest letter, but real strings of the same length are never that wide.

Thanks, I didn't get it.

If the issue only appeared on all W's I'd guess you could set the bug as minor and discuss if it's worth fixing. If it costs an incredible amount of time to fix it, the problem relies more on defining priorities than on having too much granularity on the testing side.

To go back on your parent post, I'd say validating funky emails is of the same level. The test team should bring up the edge cases, fixing them or not is a matter of priorities.

Re: Stop Validating Email Addresses With Your Complex Regex

#205

Post by adamzochowski »

baudehlo wrote: post #161
ljd wrote: post #113

Earlier quoted context omitted.

I hear and understand a lot of the comments on this thread mention that regex saves the user from a typo and such. So I want to vouch for a github project called mailcheck[0] by the Kicksend team that's great. At Ventata, we used to have the same issues you've all described with people forgetting things like ".com" and "gmial" vs "gmail". Once we started using mailcheck our bounce rate went way down. Now we only get…

The only thing mailcheck doesn't do is check if the domain has MX records, so valid looking domains that you'll never be able to send anything to will pass. I've tried to help this situation by creating an API for you guys: https://www.emailitin.com/email_validator

Domains without MX record can be valid, as mail servers, upon lack of MX record, will query for A record.

Re: Stop Validating Email Addresses With Your Complex Regex

#206

Post by claudius »

adamzochowski wrote: post #205
baudehlo wrote: post #161

Earlier quoted context omitted.

The only thing mailcheck doesn't do is check if the domain has MX records, so valid looking domains that you'll never be able to send anything to will pass. I've tried to help this situation by creating an API for you guys: https://www.emailitin.com/email_validator

Domains without MX record can be valid, as mail servers, upon lack of MX record, will query for A record.

Or AAAA records.

Re: Stop Validating Email Addresses With Your Complex Regex

#207

Post by claudius »

prothid wrote: post #27
Alex3917 wrote: post #7

"Feeling ambitious? Then check for the dot too: /.+@.+\..+/i. Anything more is overkill." I personally prefer: /[^@]+@[^@]+\.[^@]+/ Basically the same except that it will throw an error if someone enters an extra at sign.

Yeah, I basically check for one @ sign and some very basic sanity checking on the right side. /^[^@]+@[^@]+\.[^@.]+$/

As I just noticed, @ is valid in the local part of an email, too, it just has to be properly quoted (using \ or " "). You can send me email at

    "a# b.@c"@[IPv6:2001:4dd0:fc8c::1]
    a#\ b.\@c@[IPv6:2001:4dd0:fc8c::1]
now :-)

Re: Stop Validating Email Addresses With Your Complex Regex

#208

Post by SideburnsOfDoom »

baudehlo wrote: post #158
SideburnsOfDoom wrote: post #44

Earlier quoted context omitted.

This assumes that you get the regex 100% right and never lose a user by rejecting a valid email address. This is much harder than it seems ( http://www.ex-parrot.com/~pdw/Mail-RFC822-Address.html ), and is no guarantee an valid email address that is in use, as the article makes clear. After some very basic checks, e.g. "contains at at least 3 chars, one of which is an @", you should Just. Send. The. Email. Who bother…

Please don't quote that RFC-822 regexp when arguing this. That's for the contents of mail headers (which can include comments and so on), not an actual valid email address. A regexp for validating RFC-2821 email addresses is actually fairly simple.

Whichever RFC it is, it is not so simple that everyone gets it right. For innstance, a significant percentage of websites don't let you register email addresses containing a plus sign in the name, e.g. john.smith+foo_bar@host.com

Re: Stop Validating Email Addresses With Your Complex Regex

#209

Post by DanBC »

invisible wrote: post #202
DanBC wrote: post #172

Earlier quoted context omitted.

> In what world is not validating an email a good thing? Validating an email address is important. The way you do that is send an email to that address. You can't do it with regex, and attempting to do so leaves you open to a variety of flaws.

That is not validating - that is accepting it blindly into your database. You potentially just lost a user and/or customer (or made them unhappy because now they have to register again). Like I said, when you accept a credit card, normally you validate the formatting of the card before trying to charge money using the info. Emails are very similar.

What? They give you their email. You immediately send them an email with a confirmation link. They confirm, at which point you put their email in your database. You must send them a confirmation link because you shouldn't be sending them email in the future unless you've had them confirm their address and that they want to receive email from you.

You appear (but perhaps I'm misunderstanding you) to be asking a user to enter their email address; checking that against a regex; storing it; and sending email to it. That's bad, don't do that.

> You potentially just lost a user and/or customer (or made them unhappy because now they have to register again)

You're potentially losing customers because their valid email addresses are not validating through your broken regex; or their incorrect email is validating through your regex.

> when you accept a credit card, normally you validate the formatting of the card

Credit cards are trivially easy to check for formatting. You use the Luhn algorithm which tells you if it's possible for that number to be valid or not. This is because there's a strict format for credit cards. There is no such format for email addresses. That's why the only sensible way to check a user's email address is to send a confirmation email to them.

Re: Stop Validating Email Addresses With Your Complex Regex

#210

Post by invisible »

DanBC wrote: post #209
invisible wrote: post #202

Earlier quoted context omitted.

That is not validating - that is accepting it blindly into your database. You potentially just lost a user and/or customer (or made them unhappy because now they have to register again). Like I said, when you accept a credit card, normally you validate the formatting of the card before trying to charge money using the info. Emails are very similar.

What? They give you their email. You immediately send them an email with a confirmation link. They confirm, at which point you put their email in your database. You must send them a confirmation link because you shouldn't be sending them email in the future unless you've had them confirm their address and that they want to receive email from you. You appear (but perhaps I'm misunderstanding you) to be asking a user t…

Using a simple regex isn't a bad thing. 99.99999999% of my users aren't using a TLD so the regex .+@.+\..{1,63} is great.

The problem is that people are naive and write incorrect regexes. Also, don't attribute bad programming to me in your comments when you have no idea what regex I use - that's just rude and belligerent.

Emails are trivially easy to check for basic user errors - such as leaving off the TLD or not even providing the domain. Saying otherwise is just being naive again.

Post reply on HN