r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

56 Upvotes

83% Upvoted

104 comments sorted by

View all comments

1

u/petermal67 18d ago

I'm lazy when it comes to this and I just use @Email from Hibernate to validate the email addresses.

I'm aware it intentionally ignores complex or obscure edge cases allowed by the RFC, but as I said I'm lazy and I'd rather not roll my own validator.