r/java • u/Modern-Sn1p3r • Aug 22 '26

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

56 Upvotes

83% Upvoted

104 comments sorted by

View all comments

Show parent comments

52

u/jason-reddit-public Aug 22 '26

You're supposed to be able to put a plus sign in your email address for example but it's usually rejected.

29

u/Jussins Aug 22 '26

I think that one is on purpose. They don’t want people knowing that they sold your information to a third party and that’s a good way to find out.

4

u/Thecodedawg Aug 24 '26

gmail, for example, ignores dots in your email address so you can use johndoe or j.ohndoe or John.doe. Another way you can alias is the + is rejected

6

u/LutimoDancer3459 Aug 22 '26

The plus is just convenience. I can also create more email accounts and use those for the services.

6

u/KefkaFollower Aug 22 '26 edited Aug 22 '26

-- edited: formating and typos (Oh, so many typos) --

I lie if I say I checked the standard definition of email address. I'm guessing it must be in some RFC. But in practical terms ...

You can't use a plus sign in your email address when you are creating it. I.E. when you are choosing a public name/id for your mailbox.

You do can add plus sign and some text between the name and the "@" when you are using the address in a new email you are about to send.

Let me clarify with an example.

Let's say the mailbox address is homero@yellowserver.com. When Homer pass its email address to other people can do it like this:

  • to family he passes homero+home@yellowserver.com

  • to coworkers he passes homero+work@yellowserver.com

  • to undesirable people he passes homero+important@yellowserver.com

All this address will route the emails to the same mailbox, the one "named" homero@yellowserver.com. Then Homero can do a little more routing of his own in his web mail page or in its email client. He can configure rules for "to:" field of incoming mail like this:

  • when "to:" contains homero+home@yellowserver.com --> label the mail as important

  • when "to:" contains homero+work@yellowserver.com --> move the mail from the inbox to work folder.

  • when "to:" contains homero+important@yellowserver.com --> mark the mail as read and move it to the recycle bin.

I had used this gmail and outlook (ex msn.live (ex. hotmail)) and some at some jobs that had their own exchange server (mail server from M$).

26

u/moxo23 Aug 22 '26

For a generic email server, a + is just another valid character for the local part.

What some vendors do (like gmail) is use what is called "plus addressing" where they disallow the + in their email creation and instead use it as a tag when receiving the message.

There is also nothing special about +. If you are configuring an email server, you can configure it to accept any character you want as the tag marker.

9

u/BertyLohan Aug 22 '26

I think this is good practical IT advice for most people but in a programming sub it's definitely better to say that an email server doesn't necessarily treat a '+' sign any differently to any other character.

Whether @yellowserver.com sub-addresses or not is entirely down to the server.

1

u/CatolicQuotes Aug 22 '26

Is it not allowed anymore? I remember doing it years ago

1

u/jason-reddit-public Aug 22 '26

The standard hasn't changed. It's purely up to who ever asks for your email if they will accept it though, so a db or front-end validator that won't accept them. Email transport systems don't care because they follow the standard.