Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

There's only one sensible validation script: "Send an email with a confirm link".


Taking action with side-effects on entirely unvalidated user input is usually a pretty bad idea.


Sadly, if you're sending e-mail sanely, your mail provider likely validates recipients, and will be annoyed at you if you send them recipients they think are bogus.


The relevant rfc (on mobile; don't remember which) specifically states that intermediate servers must not validate mailboxes (local parts). And honestly the domain should be "validated" by the server doing an mx lookup; let dns handle it.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: