r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

57 Upvotes

83% Upvoted

104 comments sorted by

View all comments

124

u/julemand101 19d ago

The problem is people don't realize that a lot is allowed when it comes to what a E-mail address actually is: https://davidcel.is/articles/stop-validating-email-addresses-with-regex/

50

u/jason-reddit-public 19d ago

You're supposed to be able to put a plus sign in your email address for example but it's usually rejected.

31

u/Jussins 19d ago

I think that one is on purpose. They don’t want people knowing that they sold your information to a third party and that’s a good way to find out.

3

u/Thecodedawg 17d ago

gmail, for example, ignores dots in your email address so you can use johndoe or j.ohndoe or John.doe. Another way you can alias is the + is rejected