I'm sorry, but there's loads of issues...
See original GitHub issueHTML Tags
/^<([a-z1-6]+)([^<]+)*(?:>(.*)<\/\1>|\s+\/>)$/
Hex Value
/^#?([a-fA-F0-9]{6}|[a-fA-F0-9]{3})$/
Hex HTML/CSS color value maybe, but 0xDEADBEAF
is a perfectly valid hex value.
Password
/^[a-zA-Z0-9+_-]{6,32}$/
Slowly we’re moving the world to password phrases and everybody should be hashing their passwords. Then why the 32 char limit? And why, for Pete’s sake, are we only allowing a-zA-Z0-9+_-
and nothing else? *cries* (see also)
/^([a-z0-9+_\.-]+)@([\da-z\.-]+)\.([a-z\.]{2,24})$/
Yeah. Just. No. Another famous answer
Positive number
/^\d*\.?\d+$/
We don’t all live in the US/UK. (1,234.56
v.s. 1.234,56
)
Phonenumber
/^\+?[\d\s]{3,}$/
+123 is a valid phonenumber? Where? Phonenumbers are notoriously hard to validate (hence libphonenumber for example).
Date in format dd/mm/yyyy
/^(0?[1-9]|[12][0-9]|3[01])([ \/\-])(0?[1-9]|1[012])\2(19[0-9][0-9]|20[0-9][0-9])$/
Failed the very first ‘edge case’ I could come up with: 30/02/2016 but also 1852 or 2150 fail… ( as noted elsewhere).
Some people, when confronted with a problem, think “I know, I’ll use regular expressions.” Now they have two problems. - Jamie Zawinski
Issue Analytics
- State:
- Created 7 years ago
- Reactions:8
- Comments:9 (4 by maintainers)
Top GitHub Comments
Except that feb. 30th doesn’t exist 😉
Except that there are a gazillion ways the regex will match incorrectly (demonstrated here) or cause trouble otherwise. Have you read the stackoverflow answer I linked to?
All the ones I pointed out are very case-specific and hard, if not impossible (html, email for example), to get correct. Though I can think of improvements here-and-there I’d suggest taking them all down; for most, if not all, of the regexes there are better ways of handling and validating the inputs (like simply parsing a date(time) value to ‘validate’ it or sending an activation e-mail to verify an e-mail address).
Regexes do have their use, I’m not saying they don’t. But, as said, for most (if not all) of the examples there are much better solutions.
Edit: Here’s more I just stumbled upon.
That’s an easy answer. When it comes to email addresses, you never want to stop a valid user from signing up via email address. You would much rather take a hundred junk email address than prevent one valid user from signing up or filling out a form.