email validity

php expression to test email validity

[FromBelgium]

What is wrong with below expression to test validity of email.

It fails with email with this format: aaa.a12.co.nz

^[A-Za-z0-9\._-]+@([A-Za-z][A-Za-z0-9-]{1,62})(\.[A-Za-z][A-Za-z0-9-]{1,62})+$

[FromBelgium]

Sorry, email format that fails is:
[e-mail]

[omoutop]

hi FromBelgium!

You can find endless php email validation codes if you search for it, just Google it my friend, however, I would suggest you to use client side technologies rather than server side for simple validation purposes such as empty input boxes, valid emails etc. There is nothing wrong about php which can provide maximum validation but why let the user wait for the page to reload? You can use a very simple Javascript code onsubmit() of your form to check instantly before submitting data. This is simpler and in high traffic websites it is preffered in order to avoid server load.

I f you want it I can post the vode here!

[DrDoc]

function validate($_email) { 
  if(strlen($_email) < 7) return false; 
  if(preg_match("/^\.¦[@\.]example\.[a-z]+$/i", $_email)) return false; 
  if(!preg_match("/^" . 
    "[-_.[:alnum:]]*[-_[:alnum:]]" . 
    "@" . 
    "(" . 
      "(" . 
        "([[:alnum:]]¦[[:alnum:]][[:alnum:]-]*[[:alnum:]])\." . 
      ")*" . 
      "([[:alnum:]][[:alnum:]-]*[[:alnum:]])\." . 
      "(" . 
        "ad¦ae¦aero¦af¦ag¦ai¦al¦am¦an¦ao¦aq¦ar¦arpa¦as¦at¦au¦aw¦az¦" . 
        "ba¦bb¦bd¦be¦bf¦bg¦bh¦bi¦biz¦bj¦bm¦bn¦bo¦br¦bs¦bt¦bv¦bw¦by¦" . 
        "bz¦ca¦cc¦cd¦cf¦cg¦ch¦ci¦ck¦cl¦cm¦cn¦co¦com¦coop¦cr¦cs¦cu¦" . 
        "cv¦cx¦cy¦cz¦de¦dj¦dk¦dm¦do¦dz¦ec¦edu¦ee¦eg¦eh¦er¦es¦et¦eu¦" . 
        "fi¦fj¦fk¦fm¦fo¦fr¦ga¦gb¦gd¦ge¦gf¦gh¦gi¦gl¦gm¦gn¦gov¦gp¦gq¦" . 
        "gr¦gs¦gt¦gu¦gw¦gy¦hk¦hm¦hn¦hr¦ht¦hu¦id¦ie¦il¦in¦info¦int¦" . 
        "io¦iq¦ir¦is¦it¦jm¦jo¦jp¦ke¦kg¦kh¦ki¦km¦kn¦kp¦kr¦kw¦ky¦kz¦" . 
        "la¦lb¦lc¦li¦lk¦lr¦ls¦lt¦lu¦lv¦ly¦ma¦mc¦md¦mg¦mh¦mil¦mk¦ml¦" . 
        "mm¦mn¦mo¦mp¦mq¦mr¦ms¦mt¦mu¦museum¦mv¦mw¦mx¦my¦mz¦na¦name¦" . 
        "nc¦ne¦net¦nf¦ng¦ni¦nl¦no¦np¦nr¦nt¦nu¦nz¦om¦org¦pa¦pe¦pf¦pg¦" . 
        "ph¦pk¦pl¦pm¦pn¦pr¦pro¦ps¦pt¦pw¦py¦qa¦re¦ro¦ru¦rw¦sa¦sb¦sc¦" . 
        "sd¦se¦sg¦sh¦si¦sj¦sk¦sl¦sm¦sn¦so¦sr¦st¦su¦sv¦sy¦sz¦tc¦td¦" . 
        "tf¦tg¦th¦tj¦tk¦tm¦tn¦to¦tp¦tr¦tt¦tv¦tw¦tz¦ua¦ug¦uk¦um¦us¦" . 
        "uy¦uz¦va¦vc¦ve¦vg¦vi¦vn¦vu¦wf¦ws¦ye¦yt¦yu¦za¦zm¦zw" . 
      ")" . 
    "¦" . 
      "(" . 
        "([0-9][0-9]?¦[0-1][0-9][0-9]¦[2][0-4][0-9]¦[2][5][0-5])\." . 
      "){3}" . 
      "([0-9][0-9]?¦[0-1][0-9][0-9]¦[2][0-4][0-9]¦[2][5][0-5])" . 
    ")$/i", $_email)) return false; 
  return true; 
}

[DrDoc]

While I agree that you can successfully use JavaScript to validate form input on the client side, it is an absolute must to perform validation on the server side as well.
Anyone promoting client side validation over server side validation should send a link my way to fill out a form with JavaScript turned off. You can wreak all sorts of havoc that way ;)

For server side validation we're talking, what, 1/1000000th of a second to validate an entire form, causing an additional 100 byte load on the server? ;)

[omoutop]

Hi DrDoc!

You are right about using both technologies since javascript can be turned off, very true. However, just imagine what will a user gain if he enters anything he wants instead of a valid email (by disabling javascript) on a simple guestbook form? Both technologies must be used but in my opinion not in ALL projects, our corporate website has 30000 unique hits per day, many many forms, lots of validation and stuff.
(I try to save every single byte of bandwidth and load) I use both js and php to cut-off some server load (for those with js enabled) ;)

For simple projects (not that I mean that FromBelgium's site is simple or something like that) I rarely use php validation.

[Dijkgraaf]

^[A-Za-z0-9\._-]+@([A-Za-z][A-Za-z0-9-]{1,62})(\.[A-Za-z][A-Za-z0-9-]{1,62})+$
Is only expecting to see one full stop after the @, which is why it is failing.
Here is another expresion I found after a quick search that looks like it will cope a bit better.
^([_a-z0-9-]+)(\.[_a-z0-9-]+)*@([a-z0-9-]+)(\.[a-z0-9-]+)*(\.[a-z]{2,4})$

You can see the full routine this was in at
[developer.com...]

[omoutop]

This is a simple one in php

if (!ereg('^[a-zA-Z0-9_\.\-]+@[a-zA-Z0-9\-]+\.[a-zA-Z0-9\-\.]+$', $Email))
{
echo "email address is not valid";
}

[henry0]

More with PHP
<<<
<?

function validate_email($email)
{
// Create the syntactical validation regular expression
$regexp = "^([_a-z0-9-]+)(\.[_a-z0-9-]+)*@([a-z0-9-]+)(\.[a-z0-9-]+)*(\.[a-z]{2,4})$";

// Presume that the email is invalid
$valid = 0;

// Validate the syntax
if (eregi($regexp, $email))
{
list($username,$domaintld) = split("@",$email);
// Validate the domain
if (getmxrr($domaintld,$mxrecords))
$valid = 1;
} else {
$valid = 0;
}

return $valid;

}

?>

>>>

[DrDoc]

It depends on how important 100% accurate validation is to you, but a couple things to bear in mind is that:

-

user@example.*

(where * represents any TLD) is an invalid address and should trigger an error
-

user@###.###.###.###

should pass through, assuming the IP is potentionally valid
-

[e-mail]

should fail
- checking for "2-4" characters in the TLD is no sufficient, since the currently longest TLD has 6 characters

So far, the function I pasted earlier (which, by the way, I did not write myself ... but merely assembled from various other validators and information) handles the above scenarios. Although it is still lacking (by not checking domain name max length, or by disallowing characters which are supposedly allowed by the RFC standard [on grounds of not being supported by real-life MUAs or MTAs], or by not disallowing "reserved" IPs), it is the most complete I have seen anywhere so far.

Combine that with henry0's excellent suggestion for using

getmxrr

(if your server configuration allows it) and you can validate truly valid addresses :)

Personally I use the function in both my PHP code and in my JavaScripts.

[coopster]

You may also want to have a look at PEAR's Mail_RFC822 class. They have done a very nice job here. There is a regex in there that should suit your needs (see the 'isValidInetAddress' method of that class).

[FromBelgium]

Thanks for all the suggestions!
The simple PHP instruction from Omoutop fixed my problem. Apparently my old script did not accept domains starting with a number. I will keep the function from DrCop whenever I need something more sophisticated.