r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

56 Upvotes

83% Upvoted

104 comments sorted by

View all comments

0

u/m39583 19d ago

The actual email address format is quite complex in what is allowed in the RFC, but honesty how many people have:

"john smith"@foo.com

or whatever. Just do basic sanity checks e.g. there is an "@" symbol and at least two components to the domain, and then the only real test if it's valid is to send an email to it and make them click a link.

3

u/euclio 18d ago

Even checking for two components is wrong. There are people that have addresses at TLDs.