Hacker News Reader

Comment by burke | Hacker News Reader

I’ve never seen much point in trying to do better than .+@.+, unless you’re going to pull out the (gargantuan!) authoritative version for some reason.

View on HN

Implementing the authoritative version is a waste since you'll also need to keep an up-to-date list of TLDs, and more importantly, you might have a typo in the input that gives a valid-but-incorrect email.

After doing your simple regex, the best move is to just send a verification email and wait for the user to click the link, if you really need to be sure.

Too many sites refuse to let me register as

  "><script>alert("XSS");</script>@example.com

The oppression must end!

I think the mismatched quotes actually do make that one invalid.

shouldn't is read Bobby Tables rather than a mere XSS?

Honestly if that'd ever work, the website has bigger problems anyways.

Yeah, do simple validation, and then just send an email. Even a validated email can still be non-deliverable if there’sa typo in the domain or the first portion.

Or the user typos their address and it goes to the void or to someone else. Even a valid address can’t be assumed correct. I get a ton of emails to my old gmail that aren’t meant for me because some people are too dumb to get their email addresses correctly (even for someone’s covid vaccination appointment confirmation and details recently...) or just make a mistake.

Yep, these arcane rules are maybe relevant to the 5 or so people writing mailservers, but not to web developers.

Reply on news.ycombinator.com