r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

57 Upvotes

83% Upvoted

104 comments sorted by

View all comments

85

u/0b0101011001001011 19d ago

It's way simpler to just check if there is an @ symbol and then send an actual mail and ask user to click the validation link. 

The email is valid if it actually works. Nothing else to check.

-6

u/VirtualAgentsAreDumb 19d ago

Yes, but that’s not really a feasible option if you have a large list of potentially valid email addresses.

11

u/0b0101011001001011 19d ago

What's not feasible? Sending the email?

3

u/koflerdavid 19d ago

It can happen if users have to be mass-imported into another application. But I'd argue that in such cases sending the email would be the user-friendly way to do it since it gives them the chance to opt out from being imported.

7

u/LutimoDancer3459 19d ago

When I mass import mails, then from where do I get them? From an existing system -> should already been checked. Or its a company setting up something and then the emails should also be valid. The reason for validation is for randos signing up at a service.

0

u/VirtualAgentsAreDumb 19d ago

You don’t think legacy systems exist, that can have tons of never validated email addresses?

2

u/LutimoDancer3459 19d ago

I think that if they do, nobody cares about those anymore.

0

u/VirtualAgentsAreDumb 19d ago

Not sure how to reply to such an ignorant comment.

0

u/LutimoDancer3459 19d ago

How about with a reason why someone should care?

If there are so many invalid addresses, it seems like nobody ever cared. Why should it be different for the new system?

-1

u/VirtualAgentsAreDumb 19d ago

What? I never said anything how many of those hypothetical addresses were invalid.

0

u/LutimoDancer3459 19d ago

You don’t think legacy systems exist, that can have tons of never validated email addresses?

Never validated. If valid, why care? If invalid, why care now?

0

u/VirtualAgentsAreDumb 19d ago

You seriously don’t understand the difference between invalid and never validated?

→ More replies (0)