Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Email address validation: please stop

blog.sinjakli.co.uk

Post reply on HN
Print view View original

21–30 of 86 posts

Re: Email address validation: please stop

#21

Post by AllahJesus »

I think that recaptcha is just a better idea in regards to this. Yes, it's an extra step, but it does two things: a. verify that the person is in fact a person and b. cancel out spam bots, because of the need for the spam bots to be able to read the image, which is almost usually impossible to fake.

This way, email validation is not even important anymore to avoid spam.

Using part of what was suggested in your post, if we do both, use recaptcha and send an email validation link before sending any emails, we avoid spam to our servers and to the people from us and we save everybody a little bit of time. :)

The next issue arises with email delivery. How do we then ensure that our validation emails don't get filed as spam? Because if the user never sees it, then it becomes a hassle for them and chances are, unless they really, really wanted access to our site, they're not going to spend time contact us to help them with validation so that they can login or otherwise...

Re: Email address validation: please stop

#22

Post by retube »

EliRivers wrote: post #16
soulclap wrote: post #13

While I agree that some kinds of validation are 'too eager' and annoying, just use a 'legit' e-mail address, ffs. By including super-special characters and whatever extra features GMail or whoever provides, you're just asking for it, sorry. Especially if you're a coder yourself, you can already assume that even if it passes the initial validation, it probably won't be properly stored or escaped when the actual mail i…

The relevant RFCs make it clear what is a correct eMail address. Why should we have to put with lazy or incompetent coders who can't be bothered to meet the standard?

Yeah but not all email addresses are RFC compliant. Plenty of mail servers accept, or can be configured to accept, non-compliant addresses.

Re: Email address validation: please stop

#23

Post by gawker »

glenjamin wrote: post #5

I tend to rely on http://www.regular-expressions.info/email.html when coming to validate an email address. I do often fall into the trap of trusting the framework's built-in email validation to be correct. Apparently, this is the regex to match RFC2822 (?:[a-z0-9!#$%&' +/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&' +/=?^_`{|}~-]+) |"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f]) ")@(?:(?:[a-z…

Thanks! You learn something new from Hacker News everyday. Never thought it'd be such a long regex for emails though. I just got really confused trying to parse that in my head.

Re: Email address validation: please stop

#24

Post by perlgeek »

Please stop... to collect email addresses you don't really need.

When I participate in some kind of online community, I want to chose if I receive emails from them at all. And if not, it should be my choice if I provide any email address at all.

I have a small site where you can participate anonymously or log in, and when you create an account it's your choice if you provide an email address at all. If not, and you lose your password, you're out of luck.

Re: Email address validation: please stop

#27

Post by frobozz »

soulclap wrote: post #13

While I agree that some kinds of validation are 'too eager' and annoying, just use a 'legit' e-mail address, ffs. By including super-special characters and whatever extra features GMail or whoever provides, you're just asking for it, sorry. Especially if you're a coder yourself, you can already assume that even if it passes the initial validation, it probably won't be properly stored or escaped when the actual mail i…

How can other people work out what you mean by a 'legit' email address?

Are hyphens allowed? What about dots, underscores or numbers? Do any of those count as "super-special characters"? Just like "+", they are all permitted in standards-compliant email addresses, but I have no way of knowing whether they are permitted in addresses that you consider "legit".

Re: Email address validation: please stop

#29

Post by metageek »

retube wrote: post #20
glenjamin wrote: post #5

I tend to rely on http://www.regular-expressions.info/email.html when coming to validate an email address. I do often fall into the trap of trusting the framework's built-in email validation to be correct. Apparently, this is the regex to match RFC2822 (?:[a-z0-9!#$%&' +/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&' +/=?^_`{|}~-]+) |"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f]) ")@(?:(?:[a-z…

The problem with matching against the fully fledged RFC compliant regex is that not all email addresses are RFC compliant. As I indicated in my comment above, I've abondoned trying to "correctly" or "completely" validate email addresses. There's onyl one thing certain in an email address: it contains the "@" character.

Cam you give an example of a noncompliant address that actually works?
Post reply on HN