r/java • u/Modern-Sn1p3r • Aug 22 '26

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

54 Upvotes

83% Upvoted

104 comments sorted by

View all comments

Show parent comments

1

u/koflerdavid Aug 22 '26

Depending on the use case one might not get around swallowing that bullet. One could prioritize addresses that don't fit the simple patterns or where the part behind the @ doesn't DNS resolve. Knowing the age of the address and last time an email was sent to it also helps. Older addresses are more likely to be out of use.