Question

I have been finding some articles and post which suggest not to use the regular expression to validate user data. I am not sure of all the things but i usually find it in case of email address verification.

So i want to be clear whether using regular expression for validating user input is good or not? if it is good then what is bad with it for validating email address?

Edit:

So can we say that for basic primary validation of data types we can use regex and it is good and for full validation we need to combine it with another parser.

And for second part for email validation in general usage we can use it but as per standard it is not appropriate. Is it?

Now confusion in selecting correct one answer

Answer 1

It’s good because you can use regular expressions to express and test complex patterns in an easy way.

It’s bad because regular expressions can be complicated and there is much you can do wrong.

---

Edit    Well, ok. Here’s some real advice: First make sure that the expected valid values can be expressed using regular expression at all. That is when the language of valid values is a regular language. Otherwise you simply cannot use regular expressions (or at least not regular expressions only)!

Now that we know what can be validated using regular expressions, we should discuss what is viable to be validated using regular expressions. If we take an e-mail address as an example (like many others did), we should know what a valid e-mail address may look like (see RFC 5322):

addr-spec       =   local-part "@" domain
local-part      =   dot-atom / quoted-string / obs-local-part
domain          =   dot-atom / domain-literal / obs-domain
domain-literal  =   [CFWS] "[" *([FWS] dtext) [FWS] "]" [CFWS]
dtext           =   %d33-90 /          ; Printable US-ASCII
                    %d94-126 /         ;  characters not including
                    obs-dtext          ;  "[", "]", or "\"

Here we see that the local-part may consists of a quoted-string that may contain any printable US-ASCII character (excluding \ and "", but including @). So it is not sufficient to test if the e-mail address contains just one @ if we want to allow addresses according to RFC 5322.

On the other hand, if we want to allow any valid e-mail address according to RFC 5322, we would also allow addresses that do probably not exists or are just senseless in most cases (e.g. ""@localhost).