I am working on one of my projects where users don't need to register or login to post an advert, but they have to provide an email address so that a confirmation link can be sent to the provided address for further actions.

I was reading how poor email validation is useless and that invalid emails still can pass through most of the checking functionality. But what can go wrong if the user's email is not valid? If user's email address is //bob"the+powerfull/@mail.com and this returns as valid email through the validator, what's going to happen?

Why is a simple validation not enough? If I don't store the emails in a DB and I am just sending an email confirmation? Can't I just use preg_match or filter_var? If the user uses an email like I already mentioned, do you even want users like that to visit your page at all?

  • 3
    The point of validation from the perspective of the client is to let a user know they've probably typo'd an email address. Anything past that, you should simply let the underlying email machinery deal with. Jan 25, 2015 at 7:47
  • 1
    What's going out in the validation message? Could people try to use it for spam/covertly pass messages/who knows? Jan 25, 2015 at 7:52
  • Are you asking about email string validation, or about validating the email as a real email recipient?
    – schroeder
    Jan 25, 2015 at 19:25
  • About the string, I will check if it's a valid email with one simple function and another function checks the disposable emails Jan 26, 2015 at 19:19

4 Answers 4


There's no need for excessive validation.

An invalid e-mail address is just an invalid e-mail address, and any decent SMTP software can handle this. In fact, if you're using a library like PHPMailer (which you should), it will check the address before it even passes it to the actual SMTP service.

Of course one might come up with a scenario where an entirely broken backend somehow chokes on invalid addresses. But then it might choke on specially crafted valid addresses as well. You'd rather fix the backend then try to work around the problem on the frontend.

Sure, basic validation makes sense, because it provides defense-in-depth, increases usability and reduces the amount of unnecessary work. But going beyond filter_var() isn't necessary. By the way, I'm not aware of any bugs in this function. It's more restrictive than required (e. g. comments aren't allowed), but it should indeed catch all invalid addresses.


"There is no simple regular expression for this problem: see this fully RFC‑822–compliant regex, which is anything but simple. (It was written before the days of grammatical patterns.) The grammar specified in RFC 5322 is too complicated for primitive regular expressions."


A valid regex to parse email addresses according to RFC5322 is 6169 characters long.

The regex I recommend for your case is /.@./ (at least one character before and one after an @ sign). Strong email validation is not necessary and not recommended. What you can do is remember the user using cookies and give them the option to change the email address they provided.

  • If you do so, check the behavior of your system: the email address \r\nFrom:evil@email.me would fit the regex, but might end up in headers injection when sending the email (still, then, issue is probably more in the way the address is injected in the email to send, but it's worth mentioning that)
    – Xenos
    Jul 4, 2018 at 10:14

As a general answer:

It seems like without ensuring a valid email, a user could waste time waiting for a validation email that isn't coming.

Ensuring input accuracy will minimize overall user frustration, potentially leading to repeat users.


Why is a simple validation not enough?

It's far from clear from your question what you consider simple validation.

An email address (or more correctly an ADDR_SPEC) can conform to the regex signposted by @f.ardelian and the mail will still be undeliverable

An email address can have a domain which has a valid MX record and still be undeliverable.

And email address can reference a valid mailbox at a valid server and still be undeliverable.

But just blindly sending out a confirmation email to the address supplied the user has many issues:

  • there is a disconnect between the data entry and the validation - no immediate feedback for users means that they blame you when their ad doesn't get posted

  • there is scope for DOS against your service and specific mailboxes by abusing the service

Not the answer you're looking for? Browse other questions tagged or ask your own question.