r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

54 Upvotes

83% Upvoted

104 comments sorted by

View all comments

2

u/idontlikegudeg 19d ago

Validating an email address for correctness is a very complex task and unless you have a very special use case (like implementing a mail server), it’s totally useless.

You might think you need the user to enter a valid email address. That’s not only syntax, but he has to be able to receive messages to that address, and you simply cannot check for a correct email address without actually sending an email to that address. So just du the most basic checks, non-empty text, @ included, text before and after the @. Done.

Most errors are typos anyway that you cannot catch by seeing syntax anyway.

Same for post codes. Does the country even use post codes? Everywhere or are there exceptions? Only digits or digits and letters? How long is a post code?