Are all form fields (with the exception of password fields) validated with a restrictive regex?
Please, whatever you do, do not try to regex validate people's names. A friend couldn't complete an order on a site the other day because it was rejecting his name as "invalid" per its shitty regex.
See also Falsehoods Programmers Believe About Names[1]
Or email addresses, without knowing all the legal characters. (An annoying percentage reject '+', which is a great Gmail tool for spotting how your email address "leaks out".)
In addition, a poorly written Regex can open you up to a Regular Expression DOS attack. If anything, it should be on the security checklist as something not to do.
Comments
Please, whatever you do, do not try to regex validate people's names. A friend couldn't complete an order on a site the other day because it was rejecting his name as "invalid" per its shitty regex.
See also Falsehoods Programmers Believe About Names[1]
[1] http://www.kalzumeus.com/2010/06/17/falsehoods-programmers-b...
<do not try to regex validate people's names>
Or email addresses, without knowing all the legal characters. (An annoying percentage reject '+', which is a great Gmail tool for spotting how your email address "leaks out".)
And a huge number don't suport email addresses with 'bare' tld's.
see rfc 7085 "Top-Level Domains That Are Already Dotless"
https://webcache.googleusercontent.com/search?q=cache:rySaMA...
I thought those weren't allowed / encouraged by either ICANN nor IAB? They have a real-world possibility of colliding with internal hostnames.
In addition, a poorly written Regex can open you up to a Regular Expression DOS attack. If anything, it should be on the security checklist as something not to do.
A friend and I made this for fun. It is a joke and only here for entertainment value, don't put it in production. https://github.com/JonZudell/Genetic_Expression