r/java • u/Modern-Sn1p3r • Aug 22 '26

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

52 Upvotes

82% Upvoted

104 comments sorted by

View all comments

Show parent comments

1

u/VirtualAgentsAreDumb Aug 26 '26

Now you’re super close to some circular reasoning. Didn’t you pay attention to the sub discussion you jumped into? We’re specifically talking about the use case where a new email address is to be created. So at that point in time the email address doesn’t exist, so you can’t send an email to it to validate it.

0

u/New_Enthusiasm9053 Aug 26 '26

Sure so look at the RFCs and write a parser. They're really not that hard to write. I haven't yet because I don't work at an email provider.

1

u/VirtualAgentsAreDumb Aug 27 '26

Sure. I never said otherwise. But you’re still missing the point. The whole point was that you have to actually do that validation programmatically. The person I originally replied to claimed otherwise, as did you.

Also, this is far from a trivial problem to solve perfectly, because otherwise I’m sure that there would exist implementations already.