How to check similar emails in login script

[impact]

Dear,

I just discovered a problem that never existed in my mind before. I have a regular signup script which accepts username, email and password.

I do not allow special characters or upper case in username so a standard search in the mysql database yields the desired result.

However, for email i do allow special character such as " . " I just realized that, in case of gmail when I email to [e-mail] or [e-mail] or [e-mail] the email will be delivered to [e-mail]. This means that a person with one gmail id can create multiple account on my site. Which would be bad for me.

Please any one, any suggestion on this please?

Thank you.

[lostdreamer]

Eehm... I dont know how you're sending your emails, but when sending email to [e-mail], it will (**SHOULD**) be sent to [e-mail]

Perhaps you have a reg_exp somewhere that removes the dots?

[impact]

Thanks for replying.

Lets say your email is [e-mail]. Try sending an email to [e-mail] and you will see that in most cases, the email will arrive at [e-mail].

This special feature of gmail can allow a person to have double account in my site with the same gmail id. Which is bad. So I want to know how can i prevent this?

Thank you

[lostdreamer]

I have a few gmail domains (all with . in them)
Since every email I send to myself does go into my inbox you're saying someone with the same email as mine, but without the dots, would also get all my emails? Somehow I don't think this is the case ;)

To make sure I also created a gmail address with the same name as one of my others, but this time without any dots.

so for now I have i.e.: [e-mail] and [e-mail]

sending email to [e-mail] does not get into my [e-mail] mail address.

I have just tested this from PHP running localhost, and from a 'normal' email client.

The problem must be somewhere on your side...


Regards,
LostDreamer

[impact]

How?

I just tried creating "[e-mail]" but it has been registered by some one else, then I tried "[e-mail] and this is the message I am getting from google;

We ignore periods when checking usernames, so imp.act and impact are the same. Try a new username.

Coming back to my problem, in my script I cant ignore periods for the simple reason that, other companies such as mail.com treats
[e-mail] and [e-mail] as two independent emails.

so what now?

Well, while I am writing this, it just came into my mind that, may be as far as gmail.com is concerned, I can ignore periods as a special case when the users email is from gmail.com and for all other domain, i can count as independent email.

Thank you

[rocknbil]

Seems fairly easy then, don't allow gmail user name dots in email and reflect the same message when encountered (that gmail removes the dots.)

I never knew that about gmail. Odd.

[CSS_Kidd]

@impact: Just to confirm, I have had a gmail account for years as such - [e-mail]. No matter where the '.' is or even if it isn't used, I will still receive emails regardless. This is basically what your are being told by google's message.

I did a search on how to weed out and prevent multiple accounts created using the "gmail loophole", and there are quite a few nice code snippets that use some if statements / reg expression trickery.

Just a note here, You may want to clarify this subject by updating the title to say something like "How to check for gmail address variations in login script"

[penders]

loastdreamer: To make sure I also created a gmail address with the same name as one of my others, but this time without any dots.
so for now I have i.e.: [e-mail] and [e-mail]
sending email to [e-mail] does not get into my [e-mail] mail address.

I don't know how you managed to achieve this? This should be impossible! [e-mail] and [e-mail] are THE SAME ACCOUNT as far as gmail is concerned. As mentioned, gmail ignores the '.' when creating the unique email address.

----

Just a thought (as an end user)... if you filter periods out of @gmail addresses for the purpose of comparison, I would still like to see my email address with the periods intact (as I would have entered it) when viewing my account details. So I think this would mean you'd need an additional field in your database to hold the 'unique' email?

[impact]

@ penders

Not really, when creating a new account, we all check if that email id is already existing in our database or not. What I am going to do now is to add another layer to check the domain of the email id, if it is gmail, i will double check the database. First as it is entered by the user. Secondly,if periods exist, without period.

That should solve the problem i guess !

[penders]

If you are not storing the unique, non-period email address, then if the user entered "[e-mail]", you would need to...

#1 Check for "[e-mail]"
#2 Check for "[e-mail]"

and...
#3 Check for "[e-mail]"
#4 Check for "[e-mail]"
:
#n Check for "[e-mail]"

This should perhaps be done with a SQL regular expression [dev.mysql.com].

Or, you simply store this unique email address (without periods) in the email address field. But the user then sees their (gmail) email address without periods.

Or, you have an additional field to store the unique email address.

[penders]

Just a thought... if your target audience also includes the UK, then "@googlemail.co.uk" is another domain that makes the period optional in the name part of the email address. AND "@googlemail.co.uk" is the same account/email as "@gmail.com". So, the unique email address (for comparison purposes) of "[e-mail]" is actually "[e-mail]"!