如何使用正则表达式在javascript中验证PHP电子邮件注入的电子邮件地址？

Question

I want to avoid the occurrence of an % sign in the e-mail adress.
So the user does not add additional headers to the e-mail.

However I am totally overwhelmed with regex and cannot find the solution.

So far I have

/[%]+/

But in my whole code this does validate an e-mail adress like test@example.com% as true.
This was due to Firefox and Chrome having an internal e-mail check whan specifying type="email" for the input !!!

function validateEmail(sEmail) {
    var filter = /^[a-z0-9]+([-._][a-z0-9]+)*@([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,4}$/;
        filter2 = /^(?=.{1,64}@.{4,64}$)(?=.{6,100}$).*/;
        filter3 = /[%]+/                
        if (filter.test(sEmail) && filter2.test(sEmail) && !filter3.test(sEmail)) {
           return true;
        } else {
           return false;
        }
    }

Btw. since I am totally unable to write this myself so far, I found two solutions, which I am not sure which one is better. The upper one (1) or 2:

/^([\w-\.]+)@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.)|(([\w-]+\.)+))([a-zA-Z]{2,4}|[0-9]{1,3})(\]?)$/

What do you think?

Answer 1

You shouldn't be using regular expressions to prevent against injection. Instead use a prepared sql statement:

$stmt = $dbh->prepare("INSERT INTO REGISTRY (name, value) VALUES (:name, :value)");
$stmt->bindParam(':name', $name);
$stmt->bindParam(':value', $value);

Answer 2

I wouldn't use regex unless you fully understand what a valid email address is. Instead, you should parameterize all values so that even if malicious code is inserted, it'll just treat it as a string. See OWASP:

https://www.owasp.org/index.php/Query_Parameterization_Cheat_Sheet

---

I see that you changed the question. You're actually interested in fixing PHP email header injection. This is considerably more complex than simply filtering out a single character in email addresses. You need to check to see if hackers/bots are trying to inject multipart/form data (especially newline/carriage returns which delimit header from body of a multipart message), manipulate form and session variables, and filter names and other fields (which shouldn't contain special characters).

Email address filtering just isn't sufficient to prevent attacks. The machine itself needs to be properly configured as well. Follow this guide to do what you can to secure against php injection (includes examples for filtering out newlines and for software configuration): http://static.askapache.com/pdf/xss-csrl-injection.pdf