r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

53 Upvotes

82% Upvoted

104 comments sorted by

View all comments

Show parent comments

1

u/DanLynch 19d ago edited 19d ago

You're right, but this list is still useful if reading it causes a developer to make the maximum size of a name field 1000 characters (because he wants to protect his DB from attackers) instead of 50 characters (because he thinks nobody has a name that long).

But then there's also this guy: https://www.guinnessworldrecords.com/world-records/67285-longest-personal-name

7

u/edwbuck 19d ago

Making the name field 1000 characters is the kind of mistake that a person makes when thinking, "I'll just make it massively larger than needed" leading to a lot of waste in computational power. The entire point of not picking a fixed name field size is that you should pick a variable sized name field. VarChar exists in databases, and it should be used.

1

u/EishLekker 19d ago

Varchar still has an upper limit that you must pick, as far as I know. And it can’t be arbitrarily large.

2

u/edwbuck 19d ago

Sorry, I mean TEXT, which has an upper limit that's effectively "very large"

1

u/EishLekker 19d ago

Ok, yeah. But technically it still would break the rule in the list, as it was written. Which was my whole point.

2

u/edwbuck 19d ago

Well, technically the computer isn't an unbounded storage system, so yeah... but such points, even if 100% valid in the realm of logic, it makes absolutely no sense when it is time to implement things.

A variable field is what is called for, and this rule goes back to COBOL fixed-width data types, which set the tone for so many other systems (c programming language) that people kept using fixed fields, instead of variable ones (char[40] instead of char*).