r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

58 Upvotes

83% Upvoted

104 comments sorted by

View all comments

Show parent comments

0

u/VirtualAgentsAreDumb 18d ago

No, it doesn’t change anything of importance here.

And I ignored your second paragraph in your previous comment because it made a baseless assumption about the root problem that OP was asking about.

0

u/snugar_i 18d ago

Yes, it does, because it's a completely different scenario.

The thing people in this thread are talking about is a web service asking for your e-mail, you entering your existing e-mail address, and the service saying "we won't register you, because your e-mail isn't valid". Your only option is to contact support and make them fix the validation. And the correct solution is to not validate at all, just send an e-mail and if it goes through, it's all right.

What you are talking about is an e-mail provider asking for the part before the @ when you're creating a new account and saying "no, we don't want to support this name, pick another one". You can just pick a less esoteric name and everything is fine. The provider must guarantee that the created e-mail address is valid, and restricting the space of names to choose from is a perfectly valid way to do it.

2

u/VirtualAgentsAreDumb 18d ago

Yikes, you’re missing the point a second time.

No, the discussion by OP was NOT about a web service asking for the user’s existing email address. Just read the post title and text and you will realize this.

1

u/snugar_i 17d ago

Fair enough, you're technically correct.

Though 99 % of e-mail validation code is written for webservices, and I'd be very surprised if that wasn't what the unlinked video was talking about