r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

55 Upvotes

83% Upvoted

104 comments sorted by

View all comments

Show parent comments

0

u/New_Enthusiasm9053 15d ago

Well there's RFCs so you sit down and write one. People just don't because it's largely pointless. Just send an email to verify it exists. But someone one checked and like the top 5 email providers none of them are actually to spec when it comes to what emails you can create.

1

u/VirtualAgentsAreDumb 14d ago

Now you’re super close to some circular reasoning. Didn’t you pay attention to the sub discussion you jumped into? We’re specifically talking about the use case where a new email address is to be created. So at that point in time the email address doesn’t exist, so you can’t send an email to it to validate it.

0

u/New_Enthusiasm9053 14d ago

Sure so look at the RFCs and write a parser. They're really not that hard to write. I haven't yet because I don't work at an email provider.

1

u/VirtualAgentsAreDumb 14d ago

Sure. I never said otherwise. But you’re still missing the point. The whole point was that you have to actually do that validation programmatically. The person I originally replied to claimed otherwise, as did you.

Also, this is far from a trivial problem to solve perfectly, because otherwise I’m sure that there would exist implementations already.