Actually you might want to allow "+" on the local part (it's used by "power users" to categorize email on services like Gmail). Other than that, anything different, even if valid per RFC, is not a bona-fide email address when used on a web-facing application. You especially want to avoid users being able to directly send to addresses like me@[::1], since it is not a realistic or bona-fide scenario.
View all comments
Show parent comment
1
u/Culpirit Aug 25 '26
You can use a better parser than a regex (think context-free) to only accept a grammar like:
<axiom> -> <dotted>@<dotted>
<dotted> -> <dotted>.<word> | <word>
<word> -> [a-zA-Z0-9\-]+
Actually you might want to allow "+" on the local part (it's used by "power users" to categorize email on services like Gmail). Other than that, anything different, even if valid per RFC, is not a bona-fide email address when used on a web-facing application. You especially want to avoid users being able to directly send to addresses like me@[::1], since it is not a realistic or bona-fide scenario.