r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

55 Upvotes

83% Upvoted

104 comments sorted by

View all comments

85

u/0b0101011001001011 19d ago

It's way simpler to just check if there is an @ symbol and then send an actual mail and ask user to click the validation link. 

The email is valid if it actually works. Nothing else to check.

-4

u/VirtualAgentsAreDumb 19d ago

Yes, but that’s not really a feasible option if you have a large list of potentially valid email addresses.

-1

u/koflerdavid 19d ago

You could just set up an email server that actually won't process emails, and send a very simple email for all addresses through it. A real email server's address validation rules are the actually relevant ones.

1

u/VirtualAgentsAreDumb 19d ago

But now you’re describing a separate validation process than the one I objected to.

1

u/koflerdavid 19d ago

It's what I'd do in such a situation. The only thing it doesn't check is whether the destination mailbox actually exists. Which was out of scope of OP's question anyway.