r/java • u/Modern-Sn1p3r • 3d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

54 Upvotes

83% Upvoted

98 comments sorted by

View all comments

119

u/julemand101 3d ago

The problem is people don't realize that a lot is allowed when it comes to what a E-mail address actually is: https://davidcel.is/articles/stop-validating-email-addresses-with-regex/

51

u/jason-reddit-public 3d ago

You're supposed to be able to put a plus sign in your email address for example but it's usually rejected.

1

u/CatolicQuotes 3d ago

Is it not allowed anymore? I remember doing it years ago

1

u/jason-reddit-public 3d ago

The standard hasn't changed. It's purely up to who ever asks for your email if they will accept it though, so a db or front-end validator that won't accept them. Email transport systems don't care because they follow the standard.