Is this PHP email validation comprehensive and complete?

Question

It might be a bit redundant, and I'm not experienced enough to wrap it all into one function. But, I'm aiming for unicode email adresses and a quick loose but secure validation. How can I improve this?

note: I'm using PDO, so I'm mainly focusing on preventing HTML injection. Is this an issue ether way if I'm outputting user input in htmlspecialchars?

$email = "<strong>Bàt mâ'n</strong>@çupærman.dc";

function isValid($email) {
    return !preg_match('/[^ ]+@[^ ]+\.[^ ]{2,7}/', $email);
}

$encoded_email = htmlspecialchars($email, ENT_COMPAT, 'UTF-8');
if (isValid($email)) {
    echo $encoded_email. " is not valid!";
} else {
    if ($encoded_email===$email) {
    echo $encoded_email. " is valid!";
    } else {
        echo $encoded_email. " is not valid!";
    }
}

Answer 1

Use filters

You are a lot better off just using the built in validation filters:

$email_a = 'joe@example.com';
$email_b = 'bogus';

if (filter_var($email_a, FILTER_VALIDATE_EMAIL)) {
    echo "This (email_a) email address is considered valid.";
}
if (filter_var($email_b, FILTER_VALIDATE_EMAIL)) {
    echo "This (email_b) email address is considered valid.";
}

Handling International email addresses

International domain names are not really UTF-8 - they are punycode encoded strings (ascii). A UTF-8 local name isn't considered valid by most servers - i.e.

• foo@çupærman.dc valid (after converting the domain to punycode)
• foo@xn--uprman-quaf.dc valid (this is the above puny code converted)
• çupærman@foo.dc INvalid

if you just want to prevent injection - run the email address through striptags before processing; you could also follow this advice and use loose validation and simply send a mail to confirm the mail exists.

Answer 2

How about this?

$email = "<strong>Bàt mâ'n</strong>@çupærman.dc";

function validateEmail($email){
    $encoded_email = htmlspecialchars($email, ENT_COMPAT, 'UTF-8');
    $is_valid = !preg_match('/[^ ]+@[^ ]+\.[^ ]{2,7}/', $email);

    if( $is_valid || $encoded_email === $email ) $end = " is ";
    else $end = " is not ";

    return $encoded_email . $end . " valid.";
}

I absconded the preg_match() to return within the function INTO a variable - as it is less expensive than a function call within a function call (however, if you're doing more than just a preg_match() to validate, then revert it back to the isValid() function.

I also reworked your if/else/if/else into an (if|if)/else statement - higher readability and saves you one else call.

Also, I put your code into a function and made it return once, rather than echo three times.