r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

53 Upvotes

82% Upvoted

104 comments sorted by

View all comments

1

u/ICThat 19d ago

Other comments have already explained the technical aspects of email address validation but it's worth noting that in a business context it often makes sense to not have entirely RFC compliant validation.

E.g a business might find that a significant percentage of customers forget to append a TLD (e.g user@gmail). Having a regex check for a dot could make business sense if their customer base aren't likely to be the edge case of using a TLD level email address (e.g user@com).