Live data from Hacker News

Stop Validating Email Addresses With Your Complex Regex

davidcel.is

41–50 of 211 posts

Re: Stop Validating Email Addresses With Your Complex Regex

#41
Why not have a simple validator that works with 99% of users emails but not make it mandatory that it passes validation?

"We see that bob@localhost doesn't look like a email address are you sure it's right?"

That way you can help users that messed up their email but not prevent all the corner cases. The idea is that most email addresses fall in a very narrow subset of the RFC: user@domain.tld and most people would have entered their email wrong if it didn't match that pattern.

Re: Stop Validating Email Addresses With Your Complex Regex

#42
If you really want to do checking of email addresses right on the signup page, include a confirmation field so they have to type it twice.

No. This puts the burden of checking email validity on every user, even perfectly capable valid users. If you're validating for edge cases (mistakes or otherwise invalid addresses), treat it as an edge case and don't annoy users who can type.

Re: Stop Validating Email Addresses With Your Complex Regex

#43
post #33

My goto for email validation is /^.+?@.+?\..+?$/ Incase I've typed it wrong, that should basically work for anything that contains at least one @ and one dot, in that order, as well as at least one character at beginning, middle and end. It's served me well thusfar. Edit for clarification: The reason I prefer this over just checking for an @ is that if you're just checking for @ a common mistake like "me@hotmail,com"…

My favorite: /.\@.*\../ It should be similar to your version, but only matches just enough parts that require for email validation (i.e. "o@example.c" part of foo@example.com).

I like that, much more elegant! My only changes would be to make the middle .* into .+? as that way it requires at least one char, and the ? is for lazy repetition.

Re: Stop Validating Email Addresses With Your Complex Regex

#44

Assuming that running the regex is much faster than sending an email, it would probably be much less server load to check the regex and never send X% of emails, unless X is extremely small. (Looking up and implementing a regex) * 1 + (running the regex) * (every email) + (sending email) * (every valid email) Also, this post only considers the signup/activation use case. If you're getting an email for ecommerce to sen…

This assumes that you get the regex 100% right and never lose a user by rejecting a valid email address. This is much harder than it seems ( http://www.ex-parrot.com/~pdw/Mail-RFC822-Address.html ), and is no guarantee an valid email address that is in use, as the article makes clear.

After some very basic checks, e.g. "contains at at least 3 chars, one of which is an @", you should Just. Send. The. Email.

Who bothers to type in a complex but invalid email address? The overwhelmingly common failure modes are:

1) Nothing entered at all. The basic check catches this.

2) Deliberate invalid email address. e.g. homer.j.simpson@springfieldnuclear.com - a regex will not catch this.

3) Typo in email address. e.g. john.smith@gmial.com - a regex will not catch this either.

The regex has downsides and complexity, but essentially no benefit.

Re: Stop Validating Email Addresses With Your Complex Regex

#45

Assuming that running the regex is much faster than sending an email, it would probably be much less server load to check the regex and never send X% of emails, unless X is extremely small. (Looking up and implementing a regex) * 1 + (running the regex) * (every email) + (sending email) * (every valid email) Also, this post only considers the signup/activation use case. If you're getting an email for ecommerce to sen…

[deleted]

Re: Stop Validating Email Addresses With Your Complex Regex

#46
IF I were to validate by regex, I would put a confirmation for emails that I couldn't validate that read "We are very sorry but your email doesn't appear to be valid, however validating emails is very difficult so it may be our mistake. Can you confirm your email is correct?" And if they don't modify it, accept it as valid. It is an extra step but seems more friendly.

Re: Stop Validating Email Addresses With Your Complex Regex

#47
Amen! Anyone else here use myemail+token@gmail.com when they have to register with their email to find out who is selling them out and to make spam filters easier?

It still amazes me that 70% of the places I attempt using foo+bar@gmail.com call it invalid. And that does not even begin to touch the myriad valid permutations that are "invalid" out there.

Re: Stop Validating Email Addresses With Your Complex Regex

#48

Don't bother even reading it. His solution is to "Just send your users an email. The activation email is a practice that’s been in use for years, but it’s often paired with complex validations that the email is formatted correctly. If you’re going to send an activation email to users, why bother using a gigantic regular expression?" Want to know why it's not more common than the regex "method"? His method has its own…

People are far far more likely to get their email address wrong by misspelling their own name or putting @hotmail.com when they meant to put @gmail.com; regex will not protect you from either of these things. We actually had an email list of ~50k people that had been validated within nothing other than "check there are at least 3 characters in the string" and when we looked at which addresses were bouncing when we se…

Spam bots, if there was no check in place to slow them down, would dwarf real people registrations in all systems always. So let's not confuse these two topics - they are different. One part of a system that allows users to register needs to ensure that you have an identifier for a customer and a way to contact that customer, and other techniques try to ensure that you aren't allowing the spammers in the door. Whether you use regex or sending an activation email - neither of those can tell you whether this email address is or is not a spammer.

Re: Stop Validating Email Addresses With Your Complex Regex

#50
post #6

I would rather lose a few users through a faulty regexp than lose double digit percentage through an email activation step.

How many emails to asdasdasd@example.com or sdfsdf@gmail.com are you willing to pay for (the nickels add up)? What if someone uses my email address to sign up for your service?
Post reply on HN