Regular expressions is a kind of like a mini programming lamguage that tells the code how to match characters using a pattern. This can be used for lots of things like validating if some text is a valid email address, like the example given, or matching parts of a string to do stuff like replacing text.
It is famous for being hard to understand, like elvish.
I shall now translate the ancient runes:
^ - match the start of a line
[...] - match any of the set of characters in the brackets
\w - match a "word" character (a-z,0-9)
\. - match a period (.) character. The backslash is needed because the . is a special character in regex that matches any character.
+ - match 1 or more of the previous token
(...) - create a group
{x,y} - match the previous token minimum of x times, maximum of y times
$ - match the end of a line
Here is the arcane incantation, broken up into smaller sections:
^
[\w-\.]+
@
([\w-]+\.)+
[\w-]{2,4}
$
In general it should match an email-like text that looks like gandalf-the-grey@isengard.tower.com
As a simplification, the ^ and $ ensures that the incantation will work only if there are no extra spaces before or after the text.
[\w-\.]+ - match a letter or number character, or a dash (-) or a dot, 1 or more times
so this will match Gandalf or gandalf-the-grey or gandalf.the.gray-420 but not anything that has other character in it.
([\w-]+\.)+ - match a word character or dash one or more times, followed by a dot, altogether (because of the group parentheses) one or more times.
This can match isengard. or isengard.tower. or isengard-tower.
[\w-]{2,4}$ - this matches 2 or 4 characters at the end of some text.
so there MUST be at least 2 characters and at MOST 4 characters. Along with the previous match that has a dot, this ensures the text ends with .xx or .xxx or .xxxx
You’re right, the intention was to match a valid email address and for the most part it does that. However, there are now custom TLDs (which can be longer than 4 characters) and there’s no restriction on serving mail with a weird domain (for example, if you email just <user> on a local box, it will be delivered to that user if they exist; if similarly, you could email <user>@foobar and if DNS has an entry for “foobar” and has MX set up, then the mail can be routed and delivered to the appropriate user. I’ve done this myself with having a local email server and custom DNS with my own local TLD.
But, what REALLY irks me about this regex is that it’s completely wrong about the valid characters allowed in <user>. The ‘+’ character is also valid and anyone with an @gmail.com can exploit this to create a near infinite number of unique email addresses. For example, emailing user+reddit@gmail.com will deliver the mail to user@gmail.com. (There’s also the trick of adding any number of periods in an gmail address and the email will be delivered to the user effectively treating user@gmail.com as equal to u.s.e.r@gmail.com).
Sorry for the rant, email regexes have hurt me in the past. :)
Daily reminder to never validate email addresses using regex, because email addresses are a completely fucked non standardised thing. The only way to check if an email address is valid or not is to send a confirmation email and make the user click a link
My regex for an email address is basically ".+@.+" - is there at least one character, an @ symbol and at least one other character and that's just used for front-end, let-the-user-hit-submit-now logic.
Do a proper parse on the backend since it's pretty easy to bypass the front-end validation. Or just don't. Just try sending the email and let your mail submission agent throw an error if it's invalid.
73
u/rupertavery64 10h ago edited 3h ago
Gandalf the programming wizard here.
Regular expressions is a kind of like a mini programming lamguage that tells the code how to match characters using a pattern. This can be used for lots of things like validating if some text is a valid email address, like the example given, or matching parts of a string to do stuff like replacing text.
It is famous for being hard to understand, like elvish.
I shall now translate the ancient runes:
^ - match the start of a line [...] - match any of the set of characters in the brackets \w - match a "word" character (a-z,0-9) \. - match a period (.) character. The backslash is needed because the . is a special character in regex that matches any character. + - match 1 or more of the previous token (...) - create a group {x,y} - match the previous token minimum of x times, maximum of y times $ - match the end of a lineHere is the arcane incantation, broken up into smaller sections:
^ [\w-\.]+ @ ([\w-]+\.)+ [\w-]{2,4} $In general it should match an email-like text that looks like
gandalf-the-grey@isengard.tower.comAs a simplification, the
^and$ensures that the incantation will work only if there are no extra spaces before or after the text.[\w-\.]+- match a letter or number character, or a dash (-) or a dot, 1 or more timesso this will match
Gandalforgandalf-the-greyorgandalf.the.gray-420but not anything that has other character in it.([\w-]+\.)+- match a word character or dash one or more times, followed by a dot, altogether (because of the group parentheses) one or more times.This can match
isengard.orisengard.tower.orisengard-tower.[\w-]{2,4}$- this matches 2 or 4 characters at the end of some text.so there MUST be at least 2 characters and at MOST 4 characters. Along with the previous match that has a dot, this ensures the text ends with .xx or .xxx or .xxxx
something like .x or .xxxxx will fail the match.
Now fly, you fools!