Hacker News Reader

Comment by madamelic | Hacker News Reader

Here's how to make sure you parse emails, addresses, names, anything user entered: use the info to verify.

Don't write a regex, don't try to check if _you_ think it is valid. If you need it to be valid, (e)mail them something at that address and get a verification code back.

The amount of times I've been told 1/2 addresses aren't valid (technically, in the US, an address can be any fraction [0]), any address over 30 characters, domains that have tlds longer than 3 characters, domains that have tlds shorter than 3 characters, domains that aren't gmail.com, on and on and on.

Just stop. Stop trying to fit user-entered content into your tiny conception of what is "valid". Your user knows better than you and there is zero chance you'll write or should write a mega regex to determine validity.

[0]: https://pe.usps.com/text/pub28/28ape_004.htm

View on HN

Not only that, but don't rely on third-party services to do your validation for you, and yes, that includes the US Post Office, if you're looking for a physical address. There are many physical addresses in the United States that the Post Office doesn't deliver mail to, and yet people live there. I know because I live in one of those places. UPS and Fed-Ex have no problem finding the address, but for regular mail I have to use a PO Box. It is frustrating when I don't know which method an online store will use. It is also frustrating when a site repeatedly tells me my address doesn't exist.

We're in the same boat, and it gets worse than this. Our local post office asks that when addressing packages to be shipped by UPS or FedEx, we include our PO Box as an apartment number.

The reason for this is that parcel services sometimes have agreements with USPS to hand off last-mile delivery to USPS. Which means USPS is stuck trying to figure out how to deliver a package to an address they don't serve.

Adding the PO Box number as an apartment number gets them over this hump. Needless to say, it causes absolute havoc with address validation. All of the humans locally involved in delivery know what's up and it all just works, but getting an address following this convention past the computers can be a special kind of hell.

It also turns out that at least one validation service thinks our street address is in a different zip code than it actually is. Having to fudge the address with merchants using such validation services sometimes ends with a trip to the wrong post office and profuse apologies while they rummage through the back looking for a package that's genuinely misaddressed, but wouldn't have been shipped otherwise.

Please, please give your users an escape hatch to use the address as entered, even if it doesn't validate.

Assuming the USPS and physical addresses are in the same town, the following format can work quite well:

314 Something Rd / PO 404

Town, City 12345

This works because the postal service tries to deliver to the last thing on the label that they recognize. Using slash as a separator works better than a comma or newline because it's less likely the service you're shipping from will "notice" that you put a PO box in and force the package to send via USPS.

The same goes for Canada Post for addresses here in America's hat; I've been to addresses that exist but don't have postal codes, and others that can't even be looked up, and those in southern Ontario. We've made sure that users can still enter addresses manually even when using Canada Post's address widget on our websites.

The problem is a whole slew of users don't know how to enter their email appropriately, and you basically just lose them if you rely on "email -> verification code" to verify their email, but if you tell them they did something wrong right at that moment, they may be able to fix it.

Give them a warning that their email doesn't seem valid at that point, but let them go through the verification regardless.

Reply on news.ycombinator.com