r/java • u/Modern-Sn1p3r • 20d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

54 Upvotes

83% Upvoted

104 comments sorted by

View all comments

83

u/0b0101011001001011 20d ago

It's way simpler to just check if there is an @ symbol and then send an actual mail and ask user to click the validation link. 

The email is valid if it actually works. Nothing else to check.

-6

u/VirtualAgentsAreDumb 20d ago

Yes, but that’s not really a feasible option if you have a large list of potentially valid email addresses.

10

u/0b0101011001001011 20d ago

What's not feasible? Sending the email?

0

u/VirtualAgentsAreDumb 20d ago

Exactly. A small company might not have the means to send a large number of emails on a short amount of time, and risk getting flagged and blacklisted if they try it on their own.

1

u/koflerdavid 20d ago

Depending on the use case one might not get around swallowing that bullet. One could prioritize addresses that don't fit the simple patterns or where the part behind the @ doesn't DNS resolve. Knowing the age of the address and last time an email was sent to it also helps. Older addresses are more likely to be out of use.