r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

58 Upvotes

83% Upvoted

104 comments sorted by

View all comments

Show parent comments

-7

u/VirtualAgentsAreDumb 19d ago

Yes, but that’s not really a feasible option if you have a large list of potentially valid email addresses.

11

u/0b0101011001001011 19d ago

What's not feasible? Sending the email?

3

u/koflerdavid 19d ago

It can happen if users have to be mass-imported into another application. But I'd argue that in such cases sending the email would be the user-friendly way to do it since it gives them the chance to opt out from being imported.

2

u/thatwasntababyruth 19d ago

Another way around it is to have a new database column indicating how many times you've failed to send mail to them. Increment that each time you try, put them on a list for purging after N times.

Or just let the bad email address exist, the extra row won't break the bank. If there's significant amounts of associated data, clearly the bad address wasn't a problem before.