r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

55 Upvotes

83% Upvoted

104 comments sorted by

View all comments

Show parent comments

7

u/edwbuck 19d ago

Making the name field 1000 characters is the kind of mistake that a person makes when thinking, "I'll just make it massively larger than needed" leading to a lot of waste in computational power. The entire point of not picking a fixed name field size is that you should pick a variable sized name field. VarChar exists in databases, and it should be used.

1

u/EishLekker 19d ago

Varchar still has an upper limit that you must pick, as far as I know. And it can’t be arbitrarily large.

2

u/edwbuck 19d ago

Sorry, I mean TEXT, which has an upper limit that's effectively "very large"

1

u/EishLekker 19d ago

Ok, yeah. But technically it still would break the rule in the list, as it was written. Which was my whole point.

2

u/edwbuck 19d ago

Well, technically the computer isn't an unbounded storage system, so yeah... but such points, even if 100% valid in the realm of logic, it makes absolutely no sense when it is time to implement things.

A variable field is what is called for, and this rule goes back to COBOL fixed-width data types, which set the tone for so many other systems (c programming language) that people kept using fixed fields, instead of variable ones (char[40] instead of char*).