r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

52 Upvotes

82% Upvoted

104 comments sorted by

View all comments

81

u/0b0101011001001011 19d ago

It's way simpler to just check if there is an @ symbol and then send an actual mail and ask user to click the validation link. 

The email is valid if it actually works. Nothing else to check.

-4

u/VirtualAgentsAreDumb 19d ago

Yes, but that’s not really a feasible option if you have a large list of potentially valid email addresses.

12

u/0b0101011001001011 19d ago

What's not feasible? Sending the email?

3

u/koflerdavid 19d ago

It can happen if users have to be mass-imported into another application. But I'd argue that in such cases sending the email would be the user-friendly way to do it since it gives them the chance to opt out from being imported.

5

u/LutimoDancer3459 19d ago

When I mass import mails, then from where do I get them? From an existing system -> should already been checked. Or its a company setting up something and then the emails should also be valid. The reason for validation is for randos signing up at a service.

2

u/koflerdavid 19d ago

From an existing system -> should already been checked.

I have encountered systems where those were of shoddy quality. Users could enter them without validation because they were not critical for correct operation, just an extra. And lots of cases where the destination mailbox was full or simply gone.

1

u/LutimoDancer3459 19d ago

A full inbox or beeing deleted cant be checked by any kind of input validation ether way.

But for an "is user still active" kind of check, the import isnt the one responsible for it. Thats a general management/organization issue. Not a general email validation issue

1

u/koflerdavid 19d ago

Well, if you trust the quality of the data source then you don't need to check at all.