How To Check Email Adress And Name Validity?

Sadas

May 8 2005, 04:04 PM

Hello there! I'm learning php and MySQL these days... Here I've got a little script I'm playing with...

CODE

<?php
if ($submit == "click"){
$connection = mysql_connect (localhost, username, password);
if ($connection == false){
echo mysql_errno().": ".mysql_error()."<BR>";
exit;
}
$query = "insert into email_info values ('$fullname', '$email')";
$result = mysql_db_query ("sadas_Testing", $query);
if ($result){
echo "Success!";
}
else{
echo mysql_errno().": ".mysql_error()."<BR>";
}
mysql_close ();
}
else{
echo "
<html><body>
<form method=\"post\" action=\"testing.php\">
Enter your full name
<input type=\"text\" name=\"fullname\"></input><br>
Enter your email address
<input type=\"text\" name=\"email\"></input><br>
<input type=\"submit\" name=\"submit\" value=\"click\"></input>
</form>
</body></html>
";
}
?>

It writes people names and email adresses in MySQL database. My goals is to make the script:
1) refuse not valid email adresses;
2) refuse not full names (there should be at least two words in full name field, containing only letters).

Comment/Reply (w/o sign-up)

ninjamunky

May 8 2005, 04:25 PM

For the invalid e-mail part, you should somehow make it look for "@" and "." I saw that while veiwing the source of a form once. I'm not sure how you would go about doing it though.

Comment/Reply (w/o sign-up)

Sadas

May 8 2005, 04:58 PM

Yeah, I know that...
I should make tha script to look for something like this:
XX@XX.XX
X means a letter or a number
There may be no more than one "@", but can be more than one "." Difficult...
Or maybe there are some webpage providing such services. I'm wondering becouse I've seen such scripts refusing wrong adresses many times...

Comment/Reply (w/o sign-up)

ninjamunky

May 8 2005, 05:09 PM

Here's one.

http://www.quirksmode.org/js/mailcheck.html

There's many more. I just Googled for "valid e-mail address script"

Cheers

Comment/Reply (w/o sign-up)

oncombeureum

May 8 2005, 05:27 PM

QUOTE

<html><body>
<form method=\"post\" action=\"testing.php\">
Enter your full name
<input type=\"text\" name=\"fullname\"></input><br>
Enter your email address
<input type=\"text\" name=\"email\"></input><br>
<input type=\"submit\" name=\"submit\" value=\"click\"></input>
</form>
</body></html>

its easier for email check using javascript and checked again using php (client & server side)

split fullname into 2 input than check each one of them . if must, u can merge those input .

Oncom Beureum
The Best Place in the City

Comment/Reply (w/o sign-up)

Sadas

May 8 2005, 05:33 PM

Thanks... It looks like that java scripting comes into my learning campaign too...
I'll try to make the whole script working in one piece and let you know how I'm doing.

Comment/Reply (w/o sign-up)

jonypawks

May 8 2005, 06:36 PM

I found a similar way to do it in php here. This one checks to make sure the syntax is correct as well as checking to make sure the domain for the address they entered is registered with a MX (mail exchange) record in DNS. Basically, it makes sure there's a mailserver running at that domain. The documentation on that php function can be found here. Here's the code for the php function to validate an email address:

CODE

And it returns a boolean so you could use it like this:

CODE

if (validate_email($email))
echo "Email is valid!";
else
echo "Email is invalid!";

Comment/Reply (w/o sign-up)

mastercomputers

May 8 2005, 10:18 PM

Here's a post regarding me searching for the best method of email validation, one thing that may need to be altered is the length check. Which is what I never found while reading the RFCs on the situation.

http://www.astahost.com/index.php?showtopi...findpost&p=8458

As with your script, it needs to be secured a bit more, there's no checks on user input, this is by far the worse thing that you could let run by. You may also want to make the script more uptodate with whatever version you're running of PHP, if it's greater than 4.0 then you should work on making it compatible for that, avoid PHP 5 for now till it's more mainstream.

I can help you on this, my email script in the above post is good from my point of view, it will check validity, but it won't check existence, that's something else we need to do.

We can do that easily, by sending out a confirmation email, if it's not validated within 7 days, we should remove that entry.

With full names, it's basically a similar method to the email validation, yet we make sure that information that's entered is stripped of all slashes, etc.

We need to fix up the query string for the database, we've left doors open for SQL Injection and that's not a good thing, that's why we must perform checks on the data first before trying to store it in the database.

There's also other things like making sure the form isn't tampered with, making sure it's being sent from the right location, etc.

Cheers,

MC

Comment/Reply (w/o sign-up)

Sadas

May 9 2005, 08:15 PM

OK, let's try to develope valid email input into MySQL database script then.
We should begin with writing function to validate email. Let's look at your array of matches:

CODE

/^[a-z][a-z0-9_.-]+@[a-z0-9][a-z0-9-]+\.[a-z]+(\.[a-z]+)*$/i

What about email adress with IP instead of domain, something like this:

john@87.243.154.12

Would your code allow it?

I found here some big script with explanation, so we could use some ideas from it... But I think the best way would be simply to check two main things: if email has "@" and at least one "." and then send confirmation email with some code to confirm. Entry would be added to MySQL only then, when confirmation code would be received.
I'm suggesting that becouse we don't know if there are email adresses breaking the rules of RFC 2822. More of that, with IPv6 it's possible to have IPs like this:

2014:5107:45c7:d::a05:66
I wonder can it be used instead domain or not...
email adress would be really strange:
john@2014:5107:45c7:d::a05:66 (how about validating that?

)

So what do you think?

Comment/Reply (w/o sign-up)

mastercomputers

May 9 2005, 10:39 PM

Hey Sadas, thanks for the link above.

This guy has saved me a lot of work tracking down specific information. However IPv6 is not checked for in this, and I've read in the RFC that IPv4 and IPv6 are valid, but the preferred method is domain or more correctly Fully Qualified Domain Name (FQDN).

What I don't understand is he's saying what is valid and what is not, then in his script he's not actually testing for what he said, he's just testing in general. Especially overlooking the formatting of how a username can appear at the beginning of an email.

I would have been more impressed if he had actually worked on what's valid and what's not. Which is the whole reason for a validator, and hopefully all MTAs have all got a method of validating whether the address is formed correctly or not. Might save me even more effort in reading the RFCs further if I can just find that part of the code.

Cheers,

MC

Comment/Reply (w/o sign-up)

How To Check Email Adress And Name Validity? - Refusing wrong info in a form...

How To Check Email Adress And Name Validity? - Refusing wrong info in a form...