If you're going to use a Regex, this should work for strictly formatted ZIPs:
^\d{5}([-+]?\d{4})?$
- 12345
- 123456789
- 12345-6789
- 12345+6789
- 12345-67ND (yes, you read that right, sometimes the last two can be ND)
But there's still a problem. Some applications try to interpret 5-digit ZIPs as integers--for example Microsoft Excel. This means that sometimes ZIPs which have zeros in front, such as those in New England and Puerto Rico, oftentimes have problems. As such, you may also want to consider looking for 3-digit and 4-digit values.
The "first" ZIP Code in the USA is 00501 and is the IRS. (Perhaps we shouldn't allow that one to verify!) When interpreted as an integer, it's 501. Now we've got a problem.
This is important to know because, unlike credit cards which have a mod 10 checksum, addresses are not self validating. This means that you can't know if an address is formatted and standardized properly without some kind of external authority.
And once you've gone as far as needing to standardize an address via an external authority, you can have the address verified and confirmed as well.
I should mention that I'm the founder of SmartyStreets. We have a web-based address verification service where you can submit your addresses to us in a list of programmatically and we'll clean them up, standardize them, and verify them.