-1

I'm getting a lot of critics on my scripting, With my register i'm using:

(empty($_POST['email']))

There are some guys who say that that isn't good, any better alternatives?

Also i'm using preg_march for my email valitdation:

if (preg_match("/^([a-zA-Z0-9])+([a-zA-Z0-9\._-])*@([a-zA-Z0-9_-])+([a-zA-Z0-9\._-]+)+$/", $_POST['email'])) {

There is one guy who says i need to use Filter_validate and there is a guy who is telling me to use strlen any answers?

And at last: I'm sending an activation email by using:

mail($Email, 'Activeer je account!', $message, 'Van: NoReply@RubyCMS.com');

Is there something wrong with this? People keep saying i need to use the phpmailer class but i don't even know what that is...

Thanks

user3065852
  • 1
  • 6
    "who say that that isn't good" --- why don't you ask them why it's not good? As a newbie developer **don't** just blindly trust everyone but require a person to explain you what's wrong – zerkms Jan 13 '14 at 20:24
  • See http://stackoverflow.com/questions/3722831/does-phps-filter-var-filter-validate-email-actually-work – Mike Jan 13 '14 at 20:24
  • [Here's more info on `filter_var`](http://stackoverflow.com/questions/11568593/filter-validate-vs-preg-match-which-one-to-use) in another question. `empty` and `strlen` become irrelevant if you're using `filter_var` anyways – sjagr Jan 13 '14 at 20:25
  • @sjagr: no, it doesn't – zerkms Jan 13 '14 at 20:25
  • "People keep saying i need to use the phpmailer class but i don't even know what that is…" Did you bother doing a simple Google search? – Patrick Q Jan 13 '14 at 20:27
  • 1
    @zerkms good point. To explain to others on why you're correcting me: If no `$_POST['email']` is sent at all, then `filter_var` would break trying to access an undefined variable. `if (!empty($_POST['email'])` before the `filter_var` would prevent this. – sjagr Jan 13 '14 at 20:30

3 Answers3

2

filter_var() is about as good as you can get without going so far as to send an email to the address with a confirmation link enclosed. You can do things like DNS and MX record checks but they can add a lot of overhead and can also give you false positives.

if(!filter_var($email, FILTER_VALIDATE_EMAIL)){ 
    // bad email
}
John Conde
  • 217,595
  • 99
  • 455
  • 496
1

I would say that you should use all possible language benefits that it can give you.

if(filter_var($email, FILTER_VALIDATE_EMAIL)){

is good.

When you are using preg_match you should know regexp good. If you are not good in them, it's always possible to make a failure.

About mail it depends on how much emails you should send. If one email per hour, it's not a problem. If a lot of letter at cycle - better find other solution.

Viacheslav Kondratiuk
  • 8,493
  • 9
  • 49
  • 81
0
  1. Use if( isset($_POST['field']) && !empty($_POST['field']) ) to avoid pesky 'Undefined index' problems/messages.
  2. The 'one regex to rule them all' for fully RFC-compliant email validation is dozens of lines long, yours is not. Therefore, your regex is not fully RFC-compliant. FILTER_VALIDATE_EMAIL is fully RFC-compliant.

And whoever told you to use strlen() to validate an email address needs his internet privileges revoked.

Sammitch
  • 30,782
  • 7
  • 50
  • 77
  • 1
    You don't need `isset()` as soon as you use `!empty()` – zerkms Jan 13 '14 at 20:27
  • well you need at at least a length of 3 for an email address don t you :-) –  Jan 13 '14 at 20:33
  • isn't it better to use `if (trim(`? – user3065852 Jan 13 '14 at 20:34
  • @zerkms if you use `empty()` on a an undefined index you'll get an undefined index notice, hence `isset()` coming first. – Sammitch Jan 13 '14 at 20:42
  • @user3065852 It depends on what you are trying to accomplish. If an email has white space before or after it, it will fail the `filter_var` check. However if you want to remove white space, do it when you declare the variable, not in your `if` statement, or you will need to do it again later when trying to send the email. – Mike Jan 13 '14 at 20:44
  • 1
    @Sammitch [From the docs](http://ca3.php.net/empty): "No warning is generated if the variable does not exist. That means `empty()` is essentially the concise equivalent to `!isset($var) || $var == false`." – sjagr Jan 13 '14 at 20:45