Always treat email input as untrusted data. Even after validation, use prepared statements when saving to a database.
// Validate format if (!filter_var($email, FILTER_VALIDATE_EMAIL)) return ['valid' => false, 'message' => 'Invalid email format'];
function validateEmail($email) $pattern = "/^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]2,$/"; if (preg_match($pattern, $email)) return true; else return false;
Before validating, it is best practice to sanitize the input. This removes illegal characters (like spaces or extra tags) that might have been accidentally submitted.
function validateEmailAdvanced($email) // Regular expression validation $pattern = "/^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]2,$/"; if (!preg_match($pattern, $email)) return false;
The methods above only check if the text looks like an email. They do not check if the email address actually exists. To take validation a step further, you can check if the domain name (the part after the @ ) is capable of receiving emails.
While filter_var() is preferred, regex can be useful for custom rules:
For real-time existence checks (without sending email), you can attempt an SMTP handshake:
$port = 25; $timeout = 10;
Don't limit email lengths or characters too strictly. You might accidentally block users with long names or unique international domains.
© 2026 SereneSanctuary. All rights reserved.
Always treat email input as untrusted data. Even after validation, use prepared statements when saving to a database.
// Validate format if (!filter_var($email, FILTER_VALIDATE_EMAIL)) return ['valid' => false, 'message' => 'Invalid email format'];
function validateEmail($email) $pattern = "/^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]2,$/"; if (preg_match($pattern, $email)) return true; else return false; validate email address php
Before validating, it is best practice to sanitize the input. This removes illegal characters (like spaces or extra tags) that might have been accidentally submitted.
function validateEmailAdvanced($email) // Regular expression validation $pattern = "/^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]2,$/"; if (!preg_match($pattern, $email)) return false; Always treat email input as untrusted data
The methods above only check if the text looks like an email. They do not check if the email address actually exists. To take validation a step further, you can check if the domain name (the part after the @ ) is capable of receiving emails.
While filter_var() is preferred, regex can be useful for custom rules: This removes illegal characters (like spaces or extra
For real-time existence checks (without sending email), you can attempt an SMTP handshake:
$port = 25; $timeout = 10;
Don't limit email lengths or characters too strictly. You might accidentally block users with long names or unique international domains.