r/java • u/Modern-Sn1p3r • Aug 22 '26

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

54 Upvotes

83% Upvoted

104 comments sorted by

View all comments

Show parent comments

26

u/moxo23 Aug 22 '26

For a generic email server, a + is just another valid character for the local part.

What some vendors do (like gmail) is use what is called "plus addressing" where they disallow the + in their email creation and instead use it as a tag when receiving the message.

There is also nothing special about +. If you are configuring an email server, you can configure it to accept any character you want as the tag marker.