Validation of E-mail Return Addresses
Richard Kennedy
I am the volunteer Webmaster for the City of Des Moines, Washington. I am
writing a CGI program in PERL. The user will enter some information in a HTML
form and submit to the PERL program for processing. Since this processing
takes some time, the results are not displayed via HTML; they are e-mailed
back to the user.
I am trying to make this process as fool-proof as possible. During testing, I
noticed that most errors occurred when people entered their e-mail address.
Without a valid return e-mail address, the user can not receive the results.
Is there a method to automatically "capture" the user's e-mail address to save
them the trouble (and possible mistakes) of them entering it?
If there is no automatic method, is it possible to validate the e-mail address
entered by the user against any information sent by their browser?
Thank you in advance for your help.
Richard T. Kennedy, Webmaster
City of Des Moines
21630 11th AVE S
DES MOINES WA 98198-6398
<URL http://www.ci.des-moines.wa.us/>
Tom Phoenix
On Tue, 23 Jul 1996, Richard Kennedy wrote:
> Is there a method to automatically "capture" the user's e-mail address
> to save them the trouble (and possible mistakes) of them entering it?
There's no method that will always work, although there are methods which
will rarely work, and sometimes merely _seem_ to work. :-P
> If there is no automatic method, is it possible to validate the e-mail
> address entered by the user against any information sent by their
> browser?
No. If you borrow my computer to do something, I don't want you to
register under my e-mail address, do I? :-)
If they were giving you a telephone number, you'd have the same problem,
wouldn't you? It's just a special case of "How can I validate arbitrary
data?" In this case, you don't know it works until you try it and see that
it does.
-- Tom Phoenix http://www.teleport.com/~rootbeer/
root...@teleport.com PGP Skribu al mi per Esperanto!
Randal Schwartz Defense: Send mail to <fu...@stonehenge.com>
Chris Nandor
In article <960723173...@ci.des-moines.wa.us>,
Richard...@ci.des-moines.wa.us (Richard Kennedy) wrote:
> I am trying to make this process as fool-proof as possible. During testing, I
> noticed that most errors occurred when people entered their e-mail address.
> Without a valid return e-mail address, the user can not receive the results.
>
> Is there a method to automatically "capture" the user's e-mail address
to save
> them the trouble (and possible mistakes) of them entering it?
>
> If there is no automatic method, is it possible to validate the e-mail
address
> entered by the user against any information sent by their browser?
Basically, the security forces that be decided that it is best for the
user to supply an e-mail address only when he wants to. But I use a
little subroutine I wrote to validate their input to check for some minor
errors. Hope it helps (oh, and any fixes or suggestions to this would be
appreciated).
#-----------------------------------------------------------------#
# &pudEmail
# Validates e-mails from form
# E-mails must be in following form:
# (at least one char)@(at least one char).(at least two chars)
# and it must not contain any of the following characters:
# ;><&*`|,
# Usage:
# $pudEmail = $emailString;
# require("pudgelib.pl");
# &pudEmail;
# if ($checkPudEmail == 0) {
# $pudEmail = "valid";
# } elsif ($checkPudEmail == 1) {
# $pudEmail = "invalid";
# }
#-----------------------------------------------------------------#
sub pudEmail {
$checkPudEmail = 0;
if (($pudEmail =~ /[;,><&\*\`\|]/) || ($pudEmail !~ /^[^@]*@[^\.]*\./)
|| ($pudEmail !~ /\.[^.]{2,}$/)) {
$checkPudEmail = 1;
}
}
--Chris Nandor
pu...@pcix.com
http://www.petersons.com/~chrisn/
"Think On" -- McClellan Clan Motto
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.2
mQCPAzErumwAAAEEALH4hzMffazOLkwrJ4rDaTzm6SxAA9n7CMdDpxhtc2evxeHc
1fC4brgLjxxIjNny9oVzL07+3MFGU32ThuCw89Q5G3L/9z4TcnPrRD2VbjRFhpuZ
rbvUMgH0+xV/7sXFoGywAddCWvYeYMFFJgvcQET1LPS6E3826aYuYqnSvUsJABEB
AAG0LUNocmlzdG9waGVyIEcuIE5hbmRvciA8Y2hyaXNAaXNhYWMuYmlvbGEuZWR1
PrQoQ2hyaXN0b3BoZXIgRy4gTmFuZG9yIDxwdWRnZUBld29ybGQuY29tPg==
=V23y
-----END PGP PUBLIC KEY BLOCK-----
Randal L. Schwartz
>>>>> "Chris" == Chris Nandor <pu...@pcix.com> writes:
Chris> Basically, the security forces that be decided that it is best for the
Chris> user to supply an e-mail address only when he wants to. But I use a
Chris> little subroutine I wrote to validate their input to check for some minor
Chris> errors. Hope it helps (oh, and any fixes or suggestions to this would be
Chris> appreciated).
Chris> #-----------------------------------------------------------------#
Chris> # &pudEmail
Chris> # Validates e-mails from form
Chris> # E-mails must be in following form:
Chris> # (at least one char)@(at least one char).(at least two chars)
Chris> # and it must not contain any of the following characters:
Chris> # ;><&*`|,
Hmm. "fred&barney"@stonehenge.com is a perfectly valid email
address. Why are you rejecting it?
Get a clue. Nearly *every* character is legal on the left side
("local part") of an RFC-822 email address, as long as it is quoted
properly. Go thee hence to RFC822 for your clues.
(I'm getting *really* tired of these lusers that keep rewriting these
invalid validators. Hrmph.)
--
Name: Randal L. Schwartz / Stonehenge Consulting Services (503)777-0095
Keywords: Perl training, UNIX[tm] consulting, video production, skiing, flying
Email: <mer...@stonehenge.com> Snail: (Call) PGP-Key: (finger mer...@ora.com)
Web: <A HREF="http://www.teleport.com/~merlyn/">My Home Page!</A>
Quote: "I'm telling you, if I could have five lines in my .sig, I would!" -- me
Joshua Miller
In article <pudge-26079...@pudge.pcix.com>, pu...@pcix.com (Chris
Nandor) wrote:
> In article <960723173...@ci.des-moines.wa.us>,
> Richard...@ci.des-moines.wa.us (Richard Kennedy) wrote:
>
> > I am trying to make this process as fool-proof as possible. During
testing, I
> > noticed that most errors occurred when people entered their e-mail address.
> > Without a valid return e-mail address, the user can not receive the results.
> >
> > Is there a method to automatically "capture" the user's e-mail address
> to save
> > them the trouble (and possible mistakes) of them entering it?
> >
> > If there is no automatic method, is it possible to validate the e-mail
> address
> > entered by the user against any information sent by their browser?
>
I found that after I put a note on my page that says:
Please verify that your e-mail address is correct. I get rid of about 25% of all
registers because of an incorrect e-mail address. Thanks.
The number of incorrect e-mail address I was getting dropped from about
25% to about 2%. This in combination with the previously posted script
should rule aout most of your problems.
josh
--
**************
Joshua Miller
jo...@mac.lover.org
web: <http://JHMSWEB.teton1.k12.wy.us/josh>
try my meeting service: <http://www.automailer.com/lconline>
*************
Randal L. Schwartz
>>>>> "Glen" == Glen Becker <roa...@concentric.net> writes:
Glen> mer...@stonehenge.com (Randal L. Schwartz) wrote:
>> Hmm. "fred&barney"@stonehenge.com is a perfectly valid email
>> address. Why are you rejecting it?
>> Get a clue. Nearly *every* character is legal on the left side
>> ("local part") of an RFC-822 email address, as long as it is quoted
>> properly. Go thee hence to RFC822 for your clues.
>> (I'm getting *really* tired of these lusers that keep rewriting these
>> invalid validators. Hrmph.)
Glen> If the above was meant as sarcasm, it didn't come through.
It wasn't meant as sarcasm. This question keeps coming up. Lusers
post the very wrong answers. And then the myth continues to get
propogated. A quick search with DejaNews or AltaVista would have
shown this cycle repeated time and again, along with the voice of the
few (like mine) that try to inject some sanity into the conversation.
I'm getting tired of that. So I figured I'd step up the language.
Perhaps I've been hanging around Tom Christiansen too long. :-)
Glen> Your information is appreciated, your attitude is not.
How do *you* suggest we prevent the bad mythology from propogating,
without raising the highest of warnings when it comes up? I'm very
open to suggestions. Apparently (by this posting), my previous
strategies have not worked.
Glen Becker
mer...@stonehenge.com (Randal L. Schwartz) wrote:
>Hmm. "fred&barney"@stonehenge.com is a perfectly valid email
>address. Why are you rejecting it?
>Get a clue. Nearly *every* character is legal on the left side
>("local part") of an RFC-822 email address, as long as it is quoted
>properly. Go thee hence to RFC822 for your clues.
>(I'm getting *really* tired of these lusers that keep rewriting these
>invalid validators. Hrmph.)
If the above was meant as sarcasm, it didn't come through.
I'm sure Chris thanks you for your response..if you'll note, he did
openly request "any fixes or suggestions".
Your information is appreciated, your attitude is not.
--
Glen Becker
roa...@cris.com
If it has wings, I'll fly it.
--
Clay Shirky
>How do *you* suggest we prevent the bad mythology from propogating,
>without raising the highest of warnings when it comes up? I'm very
>open to suggestions. Apparently (by this posting), my previous
>strategies have not worked.
Well, just being able to point to an FAQ might do it (though that
seems to have only limited effectiveness for the "Parsing HTML"
question.)
RFC822, as Randal notes, is remarkably mute on the subject of valid
characters on the local side. However, RFC1035 says of the right side
labels, which are separated by periods:
"The labels must follow the rules for ARPANET host names. They must
start with a letter, end with a letter or digit, and have as interior
characters only letters, digits, and hyphen. There are also some
restrictions on the length. Labels must be 63 characters or less."
A start on a valid regexp for email might be:
m/^[^\s\n@]+\@(([a-z0-9][a-z0-9-]*[a-z0-9]\.)+[a-z]{2,3}|\[(\d{1,3}\.){3}\d{1,3}\])$/ix;
m/^[^\s\n@]+ # Any number of non-space or @ chars on the left side
\@ # Followed by the "@",
( # Followed by one of either:
( # a group of
[a-z0-9] # one letter or digit, followed by
[a-z0-9-]* # any number of letters, digits or hyphens
[a-z0-9] # one letter or digit, followed by
\. # followed by a '.'
)+ # one or more times
[a-z]{2,3} # followed by a two or three letter extension
| # or
\[(\d{1,3}\.){3}\d{1,3}\]
# a numeric IP address, e.g. clays@[198.7.0.2]
)$/ix;
This regexp could be improved by a better way of identifying 0-255 in
octal for the numeric IP addresses, and by finding a better way of
identifying valid top-level domains. It may well really want to be a
subroutine which splits on '@' and again on '.', and then checks
labels for validity.
--
Clay Shirky
Rahul Dhesi
In <ukbuh1p...@julie.teleport.com> mer...@stonehenge.com (Randal L.
Schwartz) writes:
>This question keeps coming up. Lusers
>post the very wrong answers. And then the myth continues to get
>propogated....
>How do *you* suggest we prevent the bad mythology from propogating,
>without raising the highest of warnings when it comes up?
Let's note the subject heading:
Validation of E-mail Return Addresses
Now, the question:
Just what do we mean, "validation of email addresses"?
Technical people, such as Randal, might say:
It means determining their RFC-conformance.
Users, however, really care about:
Will my replies reach this person or not?
The quetion posed by Richard...@ci.des-moines.wa.us (Richard
Kennedy) was:
During testing, I noticed that most errors occurred when people
entered their e-mail address. Without a valid return e-mail
address, the user can not receive the results...If there is no
automatic method, is it possible to validate the e-mail address
entered by the user against any information sent by their browser?
I think it's a safe guess that Richard only cares about the email
address being usable for replies.
pu...@pcix.com (Chris Nandor) responded: "I use a little subroutine I
wrote to validate their input to check for some minor errors."
It seems to me that Chris's emphasis is on detecting typing errors, and
perhaps on making sure the address is usable for replies. His program
enforces the following syntax on email addresses that it considers
valid:
# (at least one char)@(at least one char).(at least two chars)
# and it must not contain any of the following characters:
# ;><&*`|,
Randal responds:
Hmm. "fred&barney"@stonehenge.com is a perfectly valid email
address. Why are you rejecting it?
Get a clue. Nearly *every* character is legal on the left side
("local part") of an RFC-822 email address, as long as it is quoted
properly. Go thee hence to RFC822 for your clues.
Randal takes the words 'valid' and 'legal' to mean 'RFC-conforming'.
On the other hand, the average user takes something to be valid when "it
works" and to be invalid when "it doesn't work". As a user I just want
to get my work done. If email to an address bounces, the address is
invalid. If email gets delivered, the address is valid. (Even if it
was not RFC-conforming.) As a simple example, there are people (see my
.signature for an example) who will tell you that a simple address like
dhesi
is horribly broken and not RFC-conforming. But for local mail it
works just fine. It even works just fine if you connect from some
remote host to the SMTP port of one of the machines here and give it a
command like 'rcpt to: dhesi'. If it works, it works.
Now let's ask this question:
Is testing for RFC-conformance a good way of detecting typing
errors in email addresses? Or would it be better to check
for some common email address formats instead?
The strategy used by pu...@pcix.com (Chris Nandor), of checking
for certain formats and certain special characters, might be useful if
our only goal is to warn the user about possible errors. But Chris's
strategy will fail badly on some addresses if it simply rejects
addresses it cannot parse. Some people will have addresses that don't
fit Chris's mold.
Randal's strategy, of checking only for RFC conformance, fails too. It
will accept many possible typographical errors that will generate an
invalid (undeliverable) address that is valid (RFC conforming).
There really is no way of reliably checking email addresses for validity
(if defined as "does it work"). jomi...@wyoming.com (Joshua Miller)
comes close with his strategy:
I found that after I put a note on my page that says:
Please verify that your e-mail address is correct. I get rid of about
25% of all registers because of an incorrect e-mail address. Thanks.
The number of incorrect e-mail address I was getting dropped from
about 25% to about 2%. This in combination with the previously
posted script should rule aout most of your problems.
But delete his last sentence, about using the posted script, unless
you use it only to generate an "Are you sure?" question.
--
Rahul Dhesi <dh...@rahul.net>
"please ignore Dhesi" -- Mark Crispin <m...@CAC.Washington.EDU>
Clay Shirky
>while ( chop($_ = <STDIN>) ) {
>
> if ( /^ (?# match at beginning)
> ([^;><&\*`\|@]{1,}) (?# one or more of not ;<>&*`|@ )
> @ (?# @)
> ([^;><&\*`\|\.@]{1,}) (?# one or more of not ;<>&*`|.@ )
> \. (?# .)
> ([^;><&\*`\|@]{2,}) (?# two or more of not ;<>&*`|@ )
> $ (?# match at end)
> /x ) {
> print "YES:$1:$2:$3:\n";
> } else {
> print "NO\n";
> }
>}
>I added the @ to all the character classes so that addresses like
>kyle@blaney@nt.com@puter were not allowed. I added the dot to the
>second character class so that addresses like kyle@... were not allowed.
>Are there any other illegal addresses that pass this regex?
Yes. According to RFC1035, email addresses are parsed into labels by
splitting on '.' This means that email addresses with periods at the
beginning or end of either the left or right side of email addresses
(eg .clays.@.panix.com. and its ilk) are illegal. Furthermore, I
think, 'cl...@panix.comsomereallylongstringhere' would match this regexp.
Then there's the other problem: valid email addresses which fail your
test. Randal's test of the perfectly valid "Fred&Bar...@rubble.com"
will fail. I am also not sure how the above regexp will handle
cl...@web.panix.com, and I am sure that clays@[198.7.0.2], a perfectly
valid (albeit rare) address will fail.
I am not sure that a regexp can do all the necessary validation. I
have begun a subroutine to handle email addresses as mail parsers do:
this is a first stab, comments welcome.
=================================================================
sub ValidateEmail {
my (@strings) = @_;
&SetArrays;
foreach $string (@strings) {
chomp $string;
&Invalid unless ($string =~ /^[^\@]+\@[^\@]+$/); # only one @
&Invalid unless ($string !~ /(\s|\n/); # no spaces
($left, $right) = split(/@/, $string);
&Invalid unless ($left =~ /(^[^.]|[^.]$)/g); # no leading or
&Invalid unless ($right =~ /(^[^.]|[^.]$)/g); # trailing '.'s
unless ($right =~ /^\[?(\d\.)+\]?$/) {
@Labels = split(/\./, $right);
$end = $Labels[-1];
for (@Labels) { # RFC1035 compliant labels
&Invalid unless (length($_) <= 63);
&Invalid unless (/^[a-zA-Z0-9][a-zA-Z0-9-]*?[a-zA-Z0-9]?$/);
}
# two or three letter top-level domains
&Invalid unless ($end =~ /^[a-z]{2}$/i || $Top{$end});
} else { # validate IP addresses
$right =~ s#^\[(.+)\]$#$1#;
@Numbers = split(/./,$right);
&Invalid unless (@Numbers == 4); # four numeric values
# first and fourth are between 1 and 255
# second and third are between 0 and 255
&Invalid unless (0 < $Numbers[0] && $Numbers[0] < 256);
&Invalid unless ($Numbers[1] < 256);
&Invalid unless ($Numbers[2] < 256);
&Invalid unless (0 < $Numbers[3] && $Numbers[3] < 256);
}
print "$string is a syntactically valid address.\n\n";
}
}
sub SetArrays {
%Top = (com => legal,
edu => legal,
net => legal,
org => legal,
mil => legal);
} # end SetArrays
sub Invalid {
my ($messages) = @_;
print "Invalid Email Address: $messages\n";
}
--
Clay Shirky
Jørn-Morten Innselset
On 29 Jul 1996 14:03:56 GMT, kbl...@nt.com (Kyle Blaney) wrote:
>I came up with this:
>while ( chop($_ = <STDIN>) ) {
> if ( /^ (?# match at beginning)
> ([^;><&\*`\|@]{1,}) (?# one or more of not ;<>&*`|@ )
> @ (?# @)
> ([^;><&\*`\|\.@]{1,}) (?# one or more of not ;<>&*`|.@ )
> \. (?# .)
> ([^;><&\*`\|@]{2,}) (?# two or more of not ;<>&*`|@ )
> $ (?# match at end)
> /x ) {
> print "YES:$1:$2:$3:\n";
> } else {
> print "NO\n";
> }
>
>}
>I added the @ to all the character classes so that addresses like
>kyle@blaney@nt.com@puter were not allowed. I added the dot to the
>second character class so that addresses like kyle@... were not allowed.
>Are there any other illegal addresses that pass this regex?
Yes - an address consisting of all digits will pass. 1...@456.789 is
validated.
---
aka vi...@hipdrome.org - http://www.bs.bi.no/~jinnsels
'If a camel flies, no one laughs if it doesn't get very far.' -Paul White
Rahul Dhesi
In <DvBJJ...@midway.uchicago.edu> Tim Pierce
<twpi...@midway.uchicago.edu> writes:
>In article <4tdusr$n...@samba.rahul.net>, Rahul Dhesi <dh...@rahul.net> wrote:
>>There really is no way of reliably checking email addresses for validity
>>(if defined as "does it work").
...
>Any system that checks for invalid e-mail addresses should not
>claim that an RFC-conforming address is `invalid'....
>To do so would simply make a farce of the standards
>process itself.
Alas, Tim falls victim to the same trap that has before snapped its jaws
over many others. He assumes that 'RFC-conforming' means 'valid'.
The RFCs do not define what is valid, legal, correct, etc. The RFCs
define only what is RFC-conforming. Validity, legality, and correctness
are nebulous concepts that mean whatever the writer wants them to mean
in a specific context. For the human being sending email, an email
address is valid if it works, and invalid if it doesn't. Since there
are RFC-conforming addresses that don't work, and non-RFC-conforming
address that do work, my point is made.
Kyle Blaney
Copy mailed to original author.
I came up with this:
while ( chop($_ = <STDIN>) ) {
if ( /^ (?# match at beginning)
([^;><&\*`\|@]{1,}) (?# one or more of not ;<>&*`|@ )
@ (?# @)
([^;><&\*`\|\.@]{1,}) (?# one or more of not ;<>&*`|.@ )
\. (?# .)
([^;><&\*`\|@]{2,}) (?# two or more of not ;<>&*`|@ )
$ (?# match at end)
/x ) {
print "YES:$1:$2:$3:\n";
} else {
print "NO\n";
}
}
I added the @ to all the character classes so that addresses like
kyle@blaney@nt.com@puter were not allowed. I added the dot to the
second character class so that addresses like kyle@... were not allowed.
Are there any other illegal addresses that pass this regex?
--
Kyle Blaney | Shad Valley - Acadia 1991
Software Designer | University of Waterloo - Class of 1996
Northern Telecom | Computer Science Major with Pure Mathematics Minor
Belleville, Ontario, Canada
Randal L. Schwartz
>>>>> "Kyle" == Kyle Blaney <kbl...@nt.com> writes:
Kyle> if ( /^ (?# match at beginning)
Kyle> ([^;><&\*`\|@]{1,}) (?# one or more of not ;<>&*`|@ )
No.
"fred&barney"@stonehenge.com is legal RFC822.
Your regex rejects it.
Stop passing along the bad stuff.
Rahul Dhesi
In <4tjnkb$r...@horton.research.canon.com.au>
gre...@research.canon.com.au (Graham Stoney) writes:
>>The RFCs do not define what is valid, legal, correct, etc.
>They most certainly do define what is legal.
Not so long as I have UUCP customers.
kee...@primenet.com
on our large "consumer" oriented site (major airline)
we don't run into many of the 'freds&barney' addresses
but we have the same problem. people are unable to
type their own naem at any given time.
i check for valid elements in some reasonable order
(periods are only allowed to follow @'s) and put in
highlighted text "please verify your email and/or
provide an alternative means of contact".
my check string is
if ( $email !~ /[\w|\.|\-]+@[\w|\.|\-]+/ ) {
err_msg("Your email address did not appear valid");
}
any simple ways to improve it?
Craig
Graham Stoney
In article <4tj89i$4...@samba.rahul.net>, Rahul Dhesi <dh...@rahul.net> wrote:
>The RFCs do not define what is valid, legal, correct, etc.
They most certainly do define what is legal. If you're going to apply a syntax
check to an address, you'll have to accept that the RFC defines what is and
what isn't the legal syntax for an address.
If you want to know whether an address is actually valid though (where valid
is defined as "will successfully get the mail to the user in question"),
that's a much harder question. The RFC won't tell you whether an address is
valid, but it does define the legal syntax, so if you're going to attempt a
syntax check instead of a validity check (because a syntax check is much
easier to do), then the RFC is what you have to follow.
Regards,
Graham
Paul David Fardy
Rahul Dhesi <dh...@rahul.net> wrote:
>There really is no way of reliably checking email addresses for validity
>(if defined as "does it work").
Tim Pierce <twpi...@midway.uchicago.edu> wrote:
>Any system that checks for invalid e-mail addresses should not
>claim that an RFC-conforming address is `invalid'....
>To do so would simply make a farce of the standards
>process itself.
Rahul Dhesi <dh...@rahul.net> wrote:
>Alas, Tim falls victim to the same trap that has before snapped its jaws
>over many others. He assumes that 'RFC-conforming' means 'valid'.
>The RFCs do not define what is valid, legal, correct, etc. The RFCs
>define only what is RFC-conforming. Validity, legality, and correctness
>are nebulous concepts that mean whatever the writer wants them to mean
>in a specific context. For the human being sending email, an email
>address is valid if it works, and invalid if it doesn't. Since there
>are RFC-conforming addresses that don't work, and non-RFC-conforming
>address that do work, my point is made.
Are you suggesting that people use ($mail_address =~ /.*/) to check
e-mail addresses? That's less than useless.
At any rate, <here&n...@st-johns.cbc.ca> is a working e-mail address
and the suggested check will not accept this address. So, by the
definition "For the human being ...", the code given is incorrect.
It should also be noted that with the recent release of BIND,
nameservers around the Internet have begun rejecting hostnames that are
not RFC-conforming; this move was recommended by CERT. It would be
useful for a Web site to notify a client that his or her address is
invalid under the RFC because non-conformant now means less and less
likely to work.
As to the issue of UUCP addresses, it doesn't apply to our site--we
don't run UUCP anymore. (Actually, we do have a few rewriting rules
for @site.uucp, but we forward the mail to another site that still
manages UUCP connections.) The bridge to UUCP must be supplied by
another host via hidden forwarding of a valid domain name or through
the open format local-part of an RFC-conformant e-mail address.
Paul Fardy
--
Paul David Fardy | p...@morgan.ucs.mun.ca
Computing and Communications | p...@InfoNET.st-johns.nf.ca
Memorial University of Newfoundland |
St. John's, NF A1C 5S7 |
Kendall P. Bullen
In article <31FF54...@mail.hh.provi.de>, "Markus L. Noga"
<mln...@mail.hh.provi.de> wrote:
>kee...@primenet.com wrote:
>> i check for valid elements in some reasonable order
>> (periods are only allowed to follow @'s) and put in
>
>Whew, you just excluded all CompuServe users. My CS email is
>10072...@compuserve.com
And a lot of other addresses too; I had e-mail on two systems that was
kendall...@blah.xxx! The period character definitely shouldn't be
screened from the left hand side completely. . . .
FYI,
Kendall
--
Kendall P. Bullen ken...@his.com, kendall...@his.com,
kbu...@tax.org, kendall...@glib.org
. . . take your pick!
Markus L. Noga
There's a whole bunch more top level domains. Just think about all the
poor foregin users you are excluding...
I thought about email address validation a couple days back, and finally
ended up with this: even if the address is formed correctly, how to
assure the machine exists? How to assure the user account exists? How to
assure the mail is going to be read?
Frankly, I think that anything beyond a regexp would be overkill. As
long as an address doesn't blow the server ("| rm -f /*"), why should
you worry so much?
--
Markus L. Noga <mln...@mail.hh.provi.de>
http://www.pdv-online.de/mlnoga
Rob Funk
In article <4telk3$a...@panix.com>, Clay Shirky <cl...@panix.com> wrote:
>identifying valid top-level domains. It may well really want to be a
>subroutine which splits on '@' and again on '.', and then checks
>labels for validity.
This is sounding more and more like sendmail itself.....
--
============= R o b F u n k =============|=========> fu...@osu.edu <=========
"A microscope locked in on one point |rf...@magnus.acs.ohio-state.edu
Never sees what kind of room that it's in"|rf...@freenet.columbus.oh.us
-- Chris Mars, "Stuck in Rewind" |http://er4www.eng.ohio-state.edu/~funkr
Markus L. Noga
kee...@primenet.com wrote:
> i check for valid elements in some reasonable order
> (periods are only allowed to follow @'s) and put in
Whew, you just excluded all CompuServe users. My CS email is
10072...@compuserve.com
--
David Siegal
Rahul Dhesi (dh...@rahul.net) wrote:
(excerpted:)
> ...The strategy used by pu...@pcix.com (Chris Nandor), of checking for
> certain formats and certain special characters, might be useful if our
> only goal is to warn the user about possible errors...to generate an "Are
> you sure?" question.
I'm sold. How do I do that? (My book's chapter on Multiple Form
Interaction pretty much went over my head; so if you (or anyone)
can help me out with an "Are you sure" script, I'd be grateful.)
Thanks,
*****************************************************************
David Siegal osc...@umd.umich.edu
.. :
. . . . .
. . . .. . . *
* . .. .
. . . : . . . .
. . . . . .
. . *:. . .
. . . . .. . .
. . . . ... . .
. . . . . : . . . .
. . . .:. . . .: .. .
. . . . . *. . :<---.you are here.
. :. . . : .. : .* . .: . :
. . . . . . . . . .. .
. . . . . . .
. .. :. . . .
. ... .
. :. . . *. . .
. *.
. . . . *. .
Clay Shirky
>>identifying valid top-level domains. It may well really want to be a
>>subroutine which splits on '@' and again on '.', and then checks
>>labels for validity.
>This is sounding more and more like sendmail itself.....
Right, and it should. Any validation subroutine which handles adresses
differently from sendmail opens itself up to errors, and for Web
servers not running sendmail for the obvious security reasons, this
was meant as a simple filter of compliant addresses.
--
Clay Shirky
Randal L. Schwartz
>>>>> "Markus" == "Markus L Noga" <mln...@mail.hh.provi.de> writes:
Markus> long as an address doesn't blow the server ("| rm -f /*"), why should
Markus> you worry so much?
Nope. You missed the mark. Like many others.
"| rm -f /*"@stonehenge.com
is a legal email address.
The proper answer is *don't get an email address anywhere near the shell*!
Then you don't have to worry about whether or not it contains
shell-significant things. After all, it's an *email* address, not
a piece of a shell command.
If you don't know how to avoid the shell, please read the CGI Security
FAQ.
Just another web-whacker and Perl hacker,
Clay Shirky
In <3200D739...@omron.co.jp> Jeffrey Friedl <jfr...@omron.co.jp> writes:
>You might try something like
> /^[-\w.]+\@[-\w.]+(?:\.[-\w.]+)*\.[a-z]{2,3}$/
I follow up to Regex Rex only with fear, but both 822 and 1035/6 are
mute about invalid characters before the @, hence Randal's
"| rm -rf /*"@foo.com and Fred&Bar...@rubble.com examples.
Also, \w overmatches after the @, since an RFC1035-compliant label is
only alpha-numerics plus -, and does not seem to inlcude _, which \w
also matches.
I think the only thing that can be said about the string prior to the
"@" is that it cannot contain an @, or a \n, and it can't begin or
end with a '.'.
--
Clay Shirky
Alan J. Flavell
On Wed, 31 Jul 1996, Markus L. Noga wrote:
> There's a whole bunch more top level domains. Just think about all the
> poor foregin users you are excluding...
"Foreign" users aren't necessarily poor...
> I thought about email address validation a couple days back, and finally
> ended up with this: even if the address is formed correctly, how to
> assure the machine exists?
A mail address specifies a mail domain, not a "machine". Well,
in some simple cases there may only be one "machine" that handles the
mail for a mail domain, but that is just one special case. In general
there can be several "machines" (actually, IP interface addresses)
listed in the MX records for a mail domain.
> How to assure the user account exists?
A mail address specifies a mail user name, not an "account". The
relationship between user names and account names is in general
known only to the mail agent at the destination. And they won't
necessarily play along with you asking them (many mail agents will
accept mail addressed to any name, and only later reject it as
unknown).
> How to
> assure the mail is going to be read?
You can't, of course.
The only solution is to email something that the user needs (e.g a
password), and refuse to let them proceed until they can quote it back
to you.
In most cases on the WWW the users will refuse to playcalong with that
strategy.
So, you reached the correct conclusion: it's not really possible to
completely check an email address, in the context of the WWW. But your
analysis was over-simplified in several respects.
Gruesse
"Wissen ist macht" "I'woass nix" "Macht nix".
Jeffrey Friedl
kee...@primenet.com wrote:
> if ( $email !~ /[\w|\.|\-]+@[\w|\.|\-]+/ ) {
> err_msg("Your email address did not appear valid");
> }
>
> any simple ways to improve it?
You might consider how it would work on:
$email = q/bite.me@o.k..,how's this/;
Also, do you realize that | is not a metacharacter within a class?
And @ is open for interpolation, so you might want to escape it.
You might try something like
/^[-\w.]+\@[-\w.]+(?:\.[-\w.]+)*\.[a-z]{2,3}$/
although this won't pass many common and valid email addresses,
including
Bill Clinton <pr...@whitehouse.com>
and
pr...@whitehouse.com (Bill Clinton)
Curious about this, I went and got RFC822 and created a regex that
would match most lexically valid addresses (I chose an arbitrary limit
for comment nesting). The resultant regex was over 4,000 bytes long!
Jeffrey
----------------------------------------------------------------------------
Jeffrey Friedl <jfr...@omron.co.jp> Omron Corp, Nagaokakyo, Kyoto 617 Japan
See my Jap<->Eng dictionary at http://www.wg.omron.co.jp/cgi-bin/j-e
or at mirrors at [enterprise.ic.gc.ca] and [www.itc.omron.com]
Brendan O Dea
In article <3200D739...@omron.co.jp>,
Jeffrey Friedl <jfr...@omron.co.jp> wrote:
>kee...@primenet.com wrote:
[snip--email address validation]
>Curious about this, I went and got RFC822 and created a regex that
>would match most lexically valid addresses (I chose an arbitrary limit
>for comment nesting). The resultant regex was over 4,000 bytes long!
Yow! But then of course if you take a look at the size of the average
sendmail.cf it's probably not quite so surprising--although admittedly
sendmail also copes with UUCP and miscellaneous pre-RFC822 kludges.
Perhaps the solution to the original poster's problem would be to hand
the address off to sendmail -bv and test the exit status. This still
won't guarantee that the address *exists*, but means that sendmail
[which will presumably be used later to send something] won't choke on
it.
sub check_address
{
local (*OLDOUT, *OLDERR);
open OLDOUT, ">&STDOUT";
open OLDERR, ">&STDERR";
open STDOUT, ">/dev/null";
open STDERR, ">&STDOUT";
my $status = system "/usr/lib/sendmail", "-bv", shift;
open STDOUT, ">&OLDOUT";
open STDERR, ">&OLDERR";
$status == 0;
}
Note--all the dicking around with file handles is to save having to
quote the address which quite possibly contains contains characters
special to the shell.
Regards,
--
Brendan O'Dea b...@tyndall.com.au
Compusol Pty. Limited (NSW, Australia) +61 2 809 0133
Rahul Dhesi
In <DvHx...@midway.uchicago.edu> Tim Pierce
<twpi...@midway.uchicago.edu> writes:
>People don't seem to believe me when I say that this is not a
>problem that can be solved easily with a regexp, but it's not.
It depends on what you mean by a regexp, aka regular expression.
It used to be that a regular expression was a pattern that could be
matched by using a finite state machine. The idea was to be able to
match patterns without any backtracking.
Common contemporary implementations of regular expressions do not seem
to follow this definition.
So just what *is* a regular expression?
Once we have the answer, we can decide whether or not regular
expressions can recognize email addresses.
Clay Shirky
>>People don't seem to believe me when I say that this is not a
>>problem that can be solved easily with a regexp, but it's not.
>It depends on what you mean by a regexp, aka regular expression.
Well, it being a perl group, the working definition around here seems
to be "stuff that does what you want when its between /'s". No one
really discusses them in terms of FSAs here.
>Once we have the answer, we can decide whether or not regular
>expressions can recognize email addresses.
Friedl already said it can be done using Perl's pattern matching
capabilities, albeit with a 4000+ byte string. As you can see from
Tim's quote above, he is not questioning whether it can be done, but
whether it can be done easily, which it clearly cannot.
--
Clay Shirky
Geoffrey Simmons
The idea of _validating_ an e-mail address may be asking too much, but it
is not unreasonable to perform a _plausibility check_.
I can testify from the experience of being the guy who received user data
from a Web page and had to send information back to the user that *many*
people send blatantly broken addresses. There is a real need to automaticaly
check them.
Maybe they can't be rejected automatcally, but it would be nice if the CGI
could come back and say, "Would you please check that e-mail address, it
looks like it might be wrong." If the user insists on sending a bad
address, then they can't be stopped; but it could be a great relief to
the poor people on the receiving end if such a check could reduce the
number of bad addresses b a sgnificant ammount.
Best,
Geoff
--
Geoffrey Simmons \ Oh how we danced, and
<mailto:sim...@informatik.uni-hamburg.de> \ We swallowed the night!
<http://elmshorn.netsurf.de/~g.simmons/> Coming soon \ For it was all ripe
<http://www.informatik.uni-hamburg.de/GRK/Geoff.html> \ For dreaming ... T.W.
Chris Gray
In article <4tookp$a...@charm.magnus.acs.ohio-state.edu>, rf...@magnus.acs.ohio-state.edu (Rob Funk) writes:
>In article <4telk3$a...@panix.com>, Clay Shirky <cl...@panix.com> wrote:
>>identifying valid top-level domains. It may well really want to be a
>>subroutine which splits on '@' and again on '.', and then checks
>>labels for validity.
>
>This is sounding more and more like sendmail itself.....
>
And sendmail has a test mode, right? So just use sendmail ... (but
check for nasties like | and `..` first).
--
__________________________________________________________________________
Chris Gray Chris...@bcs.org.uk Compuserve: 100065,2102
__________________________________________________________________________
Andreas Leibl
Hiho. :-)
kee...@primenet.com wrote:
: >>Hmm. "fred&barney"@stonehenge.com is a perfectly valid email
: >>address. Why are you rejecting it?
: on our large "consumer" oriented site (major airline)
: we don't run into many of the 'freds&barney' addresses
: but we have the same problem. people are unable to
: type their own naem at any given time.
: i check for valid elements in some reasonable order
: (periods are only allowed to follow @'s) and put in
Forgive me, but periods BEFORE the @ are very common,
many computing centers here create mail addresses like
<given name>.<name>@<domain>, and I have such addresses
myself.
Greetings
Andy
--
Dipl.-Phys. Andreas Leibl
Sektion Angewandte Informationsverarbeitung
Universitaet Ulm, Telefon: +49 731 502 3574
a...@mathematik.uni-ulm.de http://www.mathematik.uni-ulm.de/~atl/
-----------------------------------------------------------------------------
The soul would have no rainbow had the eyes no tears.