Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Validating Email Addresses With Your Complex Regex

davidcel.is

Post reply on HN
Print view View original

121–130 of 211 posts

Re: Stop Validating Email Addresses With Your Complex Regex

#121

Post by cthackers »

raawlls wrote: post #84

How about this: Add a mailto link that sets the subject to some type of token, they click the link, hit send, app catches the email, sets the correct address accordingly.

This is actually a very good idea. But most users have a throw away email address for registrations and one for personal use. And for me for example, if i click a mailto link it will open the mail client with my personal email so I'll have to copy paste all that into my gmail throwaway email that may not even be opened. So I'll have to open the browser, click on........ But is indeed a good workflow alternative to consider for email verification.

Re: Stop Validating Email Addresses With Your Complex Regex

#122

Post by rallison »

ljd wrote: post #113
nostromo wrote: post #90

I don't think this is good advice. From a previous startup we saw a ton of signups like, "john@gmail" and the like. Obviously this person will not get a validation email -- and in all likelihood will not be able to log in to his account when he returns. It's best to catch him when he's entering the information.

I hear and understand a lot of the comments on this thread mention that regex saves the user from a typo and such. So I want to vouch for a github project called mailcheck[0] by the Kicksend team that's great. At Ventata, we used to have the same issues you've all described with people forgetting things like ".com" and "gmial" vs "gmail". Once we started using mailcheck our bounce rate went way down. Now we only get…

Mailcheck looks pretty interesting - I'd been considering adding some sort of client side validation for email addresses for my personal projects, and this looks pretty solid. There are a few cases that it doesn't catch that I wish it would, but it appears it would catch a fair percentage of simple mistakes.

For example, it catches foo@gmail, but it doesn't catch foo@outlook. Of course, gmail is going to be the more common case. Still, it looks good overall and an improvement over no client side validation.

Edit: Actually, I see you can define a set of domains to check against. Very nice.

Re: Stop Validating Email Addresses With Your Complex Regex

#123

Post by jnelso99 »

fein wrote: post #25
MichaelApproved wrote: post #19

Earlier quoted context omitted.

I thought new TLD being worked on didn't need to have dots in them. Why not just check for x@x?

That's exactly what you should do. ^(.+)@(.+)$ max length is 254 according to the RFC I believe, so you can check for that too.

The bonus with that regex is that it kind of looks like a dead clown.

Re: Stop Validating Email Addresses With Your Complex Regex

#124

Post by sturgill »

raawlls wrote: post #84

How about this: Add a mailto link that sets the subject to some type of token, they click the link, hit send, app catches the email, sets the correct address accordingly.

Forging mail headers is easy enough to do that I wouldn't consider this approach to validate an email address. Sending a validation email is much harder for spammers to bypass.

Re: Stop Validating Email Addresses With Your Complex Regex

#125

Post by Quarrelsome »

whirligig wrote: post #107
bane wrote: post #79

Earlier quoted context omitted.

Because most users couldn't type their own email address, or even a properly formatted email address to save their life. "My email address is joe.aol or was it aol.com@joe? Wait joeaol@com?"

I'd say nothing of value is lost in that case. These people are very costly to support. Email has been in common use for at least 20 years. They need to step up to the plate and learn at this point.

might I remind you one of the reasons why Apple have posted record profits over the last decade? It's worth nailing the UX experience to be as inclusive as possible.

It's also worth considering that one of the biggest generational markets (baby boomers) include a lot of those people you're telling us to ignore.

Re: Stop Validating Email Addresses With Your Complex Regex

#126

Post by bjhoops1 »

smackfu wrote: post #34

The question is why people are validating the email in the first place. * to ensure it is deliverable? Well, then you better send them an email. * to let people know when they misread the labels and put something that was clearly not an email in the email field? A simple check for an at-sign is usually sufficient. * because some tester opens a ticket saying you can enter an invalid email in the email field? Yeah, tha…

> because some tester opens a ticket saying you can enter an invalid email in the email field?

This is the source of 80% of all "bugs" I've fixed over the years.

Another personal favorite: If you enter WWWWWWWWWWWWWWWWWWWW W WWWWWWWWWWWWWWWW for name, it messes up the layout on the display screen.

Re: Stop Validating Email Addresses With Your Complex Regex

#128

Post by invisible »

nostromo wrote: post #90

I don't think this is good advice. From a previous startup we saw a ton of signups like, "john@gmail" and the like. Obviously this person will not get a validation email -- and in all likelihood will not be able to log in to his account when he returns. It's best to catch him when he's entering the information.

I love these articles that are posted and the ACCURATE answer is that the article proposes bad advice.

In what world is not validating an email a good thing? It's not like emails vary after a certain complexity is reached. A better article would have been someone documenting a validation regex that approaches perfect without exceeding insane complexity.

Next we'll see articles to not run the Luhn algorithm on credit cards =/.

Re: Stop Validating Email Addresses With Your Complex Regex

#129

Post by jstanley »

A good reason to validate email addresses is to prevent SMTP injection.

Depending on how you're sending the mail, it may be possible to insert arbitrary headers and body after a \r\n in the email address field. I know I've built at least one system that is vulnerable to this. Then you can put the body after your special headers and hide the rest of the message (either as an attachment or an HTML comment).

This then makes your signup form into what is effectively an open relay.

Re: Stop Validating Email Addresses With Your Complex Regex

#130

Post by raawlls »

cthackers wrote: post #121
raawlls wrote: post #84

How about this: Add a mailto link that sets the subject to some type of token, they click the link, hit send, app catches the email, sets the correct address accordingly.

This is actually a very good idea. But most users have a throw away email address for registrations and one for personal use. And for me for example, if i click a mailto link it will open the mail client with my personal email so I'll have to copy paste all that into my gmail throwaway email that may not even be opened. So I'll have to open the browser, click on........ But is indeed a good workflow alternative to co…

Valid points. I hate mailto links in general, and can totally see the workflow getting messed up by not having your default mail client set to what you actually want.

However, I think most people know how to at least access their email (always logged in), so provided you could get them into their client, with a token, quickly, with a small number of clicks, might be interesting. Of course, it could be spam central.

Post reply on HN