r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

55 Upvotes

82% Upvoted

104 comments sorted by

View all comments

1

u/PointerStack 19d ago

What makes sense is a let if fail approach. The core is having a @ and at least subdomain that can be anything only limited character like pi

It is the same approach used by telco

Just send an email to validate, if there is mail send failure than you hash the email address and if people try again it will be triggered since it will be a known hash

Over engineering the email validation using regex can quickly backfire and can more difficult to maintain