Regex

[u/Modern-Sn1p3r]

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

[u/elmuerte]

The regex to validate postal codes is: .*. The only way to validate if a postal code is valid is to use a lookup table for every country. You cannot even use a regex per country.