Hacker News Reader

Hacker News

Comment by program | Hacker News Reader

Parent Full thread

program

I tried the most complicated regular expression in the world:

http://ex-parrot.com/~pdw/Mail-RFC822-Address.html

and the server 500'd. Just joking, it's a very good tool.

P.S. it crashed with three nested groups (((a*)))

View on HN

One of my co-workers submitted the nested groups issue to github, so I'll definitely look into that one.

I'm also going to look into the RFC822 one as well (even though rendering something that size isn't really a goal). I suspect I might not be handling massive inputs sufficiently and want to make sure to address that.

You're probably lucky it didn't render though...that SVG would be non-trivial...

As an aside. I quit using regex to validate email addresses a while ago. Part of it is that a regex that large is simply incomprehensible and very difficult to maintain and fix if something is broken. The best solution, in my opinion, is a state machine based analyzer that checks the email address character-by-character and confirms compliance with RFC5322. This would also include checking DNS for MX records (which might require following CNAME to find it).

No, stop validating emails. Not only it's error prone and will frustrate legit users but it utterly pointless.

The thing is, email input validation is only one use case for regex and emails. Here's a more sinister one: you want to build a web scraper looking for emails to add to your spam list. Put a bit more generically, you need a script that can import email addresses from a broad and unknown host of formats, and it is impractical to condition the data beforehand.

I agree that the value derived from email validation for something like a new account registration is almost nil. Just do something like an email verification round trip, which not only validates the email could be real, but also provides assurance that the user has control of the email address used.

Note: My last name is O'Kelley, which is a bit of a pain when it comes to poorly designed computer services. Some sites will strip the ' and others will escape it so that I become Mr. O\'Kelley. The worst I've seen is that my school used my complete last name in my email address, so most sign up forms refuse to even try to accept it, even though it is a valid email address. It can be a pain if I need to use my .edu address for academic discounts or verification.

Landing page. Visitor accidentally enters invalid email address and clicks send.

No validation = Gone. You lost them. You can't email them for a correction.

With validation = You catch the issue before the visitor leaves and you ask them to fix it.

Sure, it doesn't verify the 1 to 1 relationship between the email and the person. That requires a round-trip verification. I get it. At least you ensure that it isn't all garbage-in to begin with.

The other aspect of email verification is that you don't have to choose to bug the user with the results. Depending on what it is, if someone enters an obviously junky address you can simply tag that email as potential crud in your database. Someone would then manually look at these every so often for cleanup or re-categorization.

I don't like the idea of looking signups or customers in a transaction where both parties are interested in transferring the information accurately. That's a use-case where validation works well.

Now, regarding your last name. The issue is cause by programmers who simply go around grabbing code off the internet without vetting it in any way. There are email "validation" regex expressions out there that are horribly wrong, yet people post them on blogs and others use them without question. It's unfortunate.

Reply on news.ycombinator.com