Hacker News new | past | comments | ask | show | jobs | submit login

As I understand, the goal of validating e-mail syntactically, is a defense against various attacks based on injection of malicious data/code. One wants to restrict what might be entered by a user, to forbid something like "hello@example.com; sh -c sudo rm -rf /* &;". Or maybe strings which interfere with SMTP to send spam mail from site address.

Such a validation have to occur at some point before SMTP commands have been written into smtp-socket. If underlying code to send an email is safe against invalid email addresses, then there are no much reason to validate address before passing it to underlying code, but this safety could be reached only by validating address by underlying code.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: