[RESOLVED] email validation [ javaScript ]

[Aash]

hi

i want to know about email validation for the sign up form, want to do it professionally. I've done some using javascript but i want to know the conditions that are applied for email validation when any user registers on any site.



thanks..

[akhileshbc]

Javascript is used to validate at client side. So, you have to validate at server side too !

For example, if you are trying to create a "contact us" page, the main fields that you will obtain from the user are:

• Name
• Email
• Message

By using Javascript, the data entered by the user on these fields can be checked at client side (ie. the Javascript runs and validates in that user's browser). So, this validation is done before submitting the values to the actual server !

But you have to include code to validate and sanitize the email id, received at the server too. At server side, you'll be doing email validation + sanitizing the email (to remove any email headers injected into it) + cleaning it to prevent any sql injections.

For email validation, I think, the best approach is to use regular expressions (it's tough one for me )

[Aash]

so i need to make a html file with embedded javascript code using RegExp for email validation, and it'll check just before the user presses the submit button (the page will be submitted to user and data will be saved in mysql)?
am i saying right? and is this the professional way?

[PBertie]

The RegEx that I use is below, it copes with most common email addresses and pretty safe for all personal addresses. It allows all domains which are 2 characters then another 2 characters, but for others they are listed. You'll notice its not a full list, example .biz, .mobi, .jobs, ect. aren't there, you could add them or change it to allow any 3 letter domain.

emailAdd = "[email protected]";
alert("Email Valid? " + emailAdd.match(/\b(^(\S+@).+((\.com)|(\.net)|(\.edu)|(\.mil)|(\.gov)|(\.org)|(\..{2,2}))$)\b/gi) );

I would say the professional way to do it is like akhileshbc said, have some javascript function that valids the form using the onsubmit event of the form (return false to cancel the submit). But you will also need the server side to do the same validation in case the user has javascript turned off or someone makes their own form and points it at your processing script in order to put invalid data in on purpose.

[Aash]

ok, thanks

[kows]

I'd use this regular expression instead:

/^[A-Z0-9\._%+-]+@[A-Z0-9\.-]+\.[A-Z]{2,4}$/i

You won't need to maintain a list of TLDs this way.

[Aash]

thanks kows, your code is pretty simpler
one last question, after validating the form with javascript, i have to validate it again before sql statements? (i've some confusion about this)

[kows]

Yes. Validation should always be done on the server side (before your SQL, in ASP.NET/PHP/Java/Ruby/Python/etc). Validation is optional on the client side (in the browser), but can be very helpful for user experience.

It must always be done on the server side because if I turn JavaScript off and use your form, I'm essentially skipping your validation. JavaScript should never be used to provide "must have" functionality.

[Aash]

Yes. Validation should always be done on the server side (before your SQL, in ASP.NET/PHP/Java/Ruby/Python/etc). Validation is optional on the client side (in the browser), but can be very helpful for user experience.

It must always be done on the server side because if I turn JavaScript off and use your form, I'm essentially skipping your validation. JavaScript should never be used to provide "must have" functionality.

thanks