Valid e-mail addresses in the dice roller

[Zhym]

A minor note:

The registration for the forums correctly recognizes a plus sign ("+") as a valid character in an e-mail address. The dice roller, alas, does not. It would be great if this could be fixed in the dice roller.

Fortunately, it's easy enough for me to alias another e-mail address to the one I'm using (lots of other sites incorrectly treat a "+" as an invalid character. One of these days I'm going on a crusade, RFC 2822 in hand), but it would be nice to see this fixed.

[Vargr1105]

What is RFC 2822.

[Zhym]

It's the Internet standards document that specifies how e-mail (including e-mail addressing) works.

This blog post has a good discussion (aimed mostly at coders) of what a valid e-mail looks like:

http://haacked.com/archive/2007/08/21/i ... til-i.aspx

ETA: The reason the plus sign is there is for subaddressing. For example, if your main e-mail account is jolly.orc@example.com, you could set up rules to have all e-mail to jolly.orc+unseenservant@example.com filed in a particular folder. It's a great way to manage e-mail, and it's supported by Gmail, Yahoo, and others. But a lot of website e-mail validation routines reject e-mails with plus signs in them—sometimes on purpose, but more often, I suspect, not.

[AQuebman]

Its a security issue + signs are frequently seen in things like scripts that could cause some trouble so I understand why a lot of places don't allow them.

[Zhym]

Could be. But almost all sites accept hyphens in e-mail addresses, and I believe those can also be used in SQL injection attacks.

But I'm casting way above my level here. My background is in network security, with only a little knowledge of application security.

At a minimum, I'd like to see accurate error messages. "Please enter a valid e-mail address" is a bad message: my e-mail address is fine. If a registration form chooses not to accept it for other reasons, it should say so.

At any rate, my request is just for unseenservant.com to use the same validation as unseenservant.us.

[ToniXX]

Try it now post the results.

[Zhym]

I'd already registered, so I wasn't able to test the initial registration validation, but I was able to change my e-mail to the one with a plus sign.

Wow, that was fast. Thanks!

[ToniXX]

I updated the regular expression, now allowing the '+' character, and cleaned it up in a few other ways. It was something that I hadn't looked it in quite a while, and my regexp skill has improved since then.

Thanks for the input.

[AQuebman]

That and frankly if somebody is wanting to attack this site i'm sure they could easily so i'd rather have things be open and easy for everybody rather than be anal about security.