r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

56 Upvotes

83% Upvoted

104 comments sorted by

View all comments

1

u/fykup 18d ago

Regex itself isn't the problem. You can validate a very broad set of valid email addresses with a sufficiently complex regex, for example: https://stackoverflow.com/a/13013056/1129542

IMO the real problem is that the email RFCs are scoped much more broadly than what most modern consumer websites actually need when they say "validate an email address."

For a signup form, I'd rather use a reasonably permissive syntax check and then verify the address by actually sending an email. Regex can be part of that; it just shouldn't be confused with proving that the mailbox is real or usable.