Can it cause harm to validate email addresses with a regex?

Question

I\'ve heard that it is a bad thing to validate email addresses with a regex, and that it actually can cause harm. Why is that? I thought it never could be a bad thing to val

Answer 1

If your regular expression is ill-formed then you might deny valid email addresses. This goes for any "email validation" rule.

I know of an email address which is regularly denied by forms which doesn't contain any email oddities; it's merely long. It really annoys the person it belongs to because the part before the @ is their legal name - an obvious choice for an email address.

That is part of the potential harm of email validation done incorrectly: annoying users by denying valid email addresses from entering the system.