Complexities of e-mail validation logic

Re:Complexities of e-mail validation logic by harryf on Monday May 24, 2021 @02:54PM (#27268298)

I’ve always wondered if it’s possible to have a valid email address which is also an SQL injection attack, XSS or similar ?

[ Parent | on HN ]

Re:Complexities of e-mail validation logic by malinens on Tuesday May 25, 2021 @12:25AM (#27272585)

of course it can: https://security.stackexchange.com/a/106996

One of our testers found XSS with email injection (RFC compkiant validation passed) in our website.

And we are an e-mail company and should now better :D

Never trust user input!

[ Parent | on HN ]

Re:Complexities of e-mail validation logic by goto11 on Tuesday May 25, 2021 @03:06AM (#27273786)

Probably, since the local name part can be basically anything.

But the way to prevent injection attacks is not to disallow or sanitize input, it is to escape correctly when interpolating strings in other languages.

[ Parent | on HN ]