Live data from Hacker News

How not to check the validity of an email address

dellsystem.me

61–70 of 243 posts

Re: How not to check the validity of an email address

#61
post #55

Somewhat unrelated, but out of curiosity, does anyone know of a site that lists — for all popular languages — various libraries/code snippets/routines which one can use to correctly (according to the RFCs) check the validity of e-mail addresses? If not I may be compelled to create one.

Just send an email and see if it arrives.

Re: How not to check the validity of an email address

#63
This would have been so simple to just make right in the beginning. They should have just hashed each of those user names and put the hash into a dictionary. Whenever someone entered an email check if it is in the dictionary. O(1) time and it wouldn't be a "data leak vulnerability". So close...

Re: How not to check the validity of an email address

#65

I've once come across: if (!Boolean.FALSE.equals(aBoolean)) { // ... } I was pretty baffled.

I've seen a surprising amount of code that does: if (aBoolean == true) { .... }

Typically that isn't done from ignorance, just some (imho misguided) idea about readability.

Re: How not to check the validity of an email address

#66
post #56

Earlier quoted context omitted.

How did GoogleBot get access to the (presumably) private admin panel to crawl the links in the first place? Also, these sort of things require server-side authentication, not just JS. Just because GoogleBot won't crawl your PUT requests doesn't mean others won't -- including users (malicious or otherwise)! Just sayin'.

If I recall correctly the code looked something like this: if (!admin()) echo " window.location = '/signin'; "; delete_bid($_GET['bid_id']); ?>

a simple 'else' would have at least stopped the deleting part :/

Re: How not to check the validity of an email address

#67

Every single legacy application I've ever worked on has had analogous code buried in it somewhere. An application I've just been "repairing" recently has a spot where it uses two separate queries to pull two full table sized lists of values, then manually joins them with a loop, and then manually re-orders the joined values into groups selectively ignoring some rows, and then embeds the the whole reordered list in a…

> Switching it to use a single properly formatted SQL reduced load times to under a second. We need you to change it back because the system that scrapes that page is relying on the page load time.

That is, computer running the sign on the front of the store pulls data from here, and you've completely broken it because now the page loads a second time before it can finish drawing the screen. It /needs/ that delay on the HTTP request in order to catch up. A real programmer would have thought of that. Add some loops, sleeps and rands; we can talk about your reckless conduct in the morning.

Re: How not to check the validity of an email address

#68
post #48

Every single legacy application I've ever worked on has had analogous code buried in it somewhere. An application I've just been "repairing" recently has a spot where it uses two separate queries to pull two full table sized lists of values, then manually joins them with a loop, and then manually re-orders the joined values into groups selectively ignoring some rows, and then embeds the the whole reordered list in a…

> hiring random "programmers" who have history or psychology degrees and think they can program because they made a form in PHP. That's pretty unfair to people coming from history or psychology who actually can write good code. Just because you don't have a degree in CS doesn't mean your code is shit. This is purely anecdotal, but my predecessor at my current job was a CS graduate and wrote code like in the OP.

Here here. There are plenty of people who have CS degrees and can't programme. Why else do we need "FizzBuzz".

Re: How not to check the validity of an email address

#69
post #43
post #40

Gosh. For some reason, the "right answer" I expected to see was "do not try to validate the address; just send the e-mail and handle the bounce if it fails". There is a whole other layer which is very good at handling incorrect or undeliverable addresses.

Not sure you read the article - there is an additional constraint in that only email addresses pertaining to the institution in question are allowed.

Yes, I decided to ignore that constraint because it doesn't make sense :).

The article suggests performing "server-side membership testing, which is O(1)", but I think this is a bit too much — you can do even easier server-side validation without the list of all valid e-mail addresses, just the information that "@[anything but these two domains] is not an OK target".

Re: How not to check the validity of an email address

#70
post #55

Somewhat unrelated, but out of curiosity, does anyone know of a site that lists — for all popular languages — various libraries/code snippets/routines which one can use to correctly (according to the RFCs) check the validity of e-mail addresses? If not I may be compelled to create one.

/.@./ is pretty much the best you can do.

And even the dots are a bit iffy.

Post reply on HN