TalkPHP
 
 
Account Login
Latest Articles
» The basic usage of PHPTAL, a XML/XHTML template library for PHP
» Vulnerable methods and the areas they are commonly trusted in.
» Simple way to protect a form from bot
» The Basics On: How Session Stealing Works
» How to keep your forms from double posting data
IRC Channel
IRC Speech Bubble Join the friendly bunch on IRC...
(#TalkPHP on Freenode)

...Also available via a web interface.

See this thread for information on the TalkPHP Free Hugs Initiative™. Subject to availability.
Associates
Associates
CSS Tutorials
Reply
 
LinkBack Thread Tools Search this Thread Display Modes
Old 12-30-2007, 10:32 PM   #1 (permalink)
The Frequenter
 
ReSpawN's Avatar
 
Join Date: Nov 2007
Location: Netherlands
Posts: 460
Thanks: 49
ReSpawN is on a distinguished road
Default Checking valid Email Addresses using RegExp (and?)

Hey guys,

For my CMS, I am using the Revised RegEx function from Matt83. Thanks a bunch Matt! Love the work, also thanks to Salathe for the creds and Adam for the sharp eye noticing the {3,3} - {3}. Notice that I am -NOT- a RegEx specialist. To be honest, I suck at it.

Since it's for my CMS, it's gotta be pretty fool-fail proof. I am going to link it to a dns record database using the functions supplied by PHP itself. (defined in the installation to use it. IF it takes too long, you can't use it)

Now the hard part. The RegEx. I want to use it everywhere, so it has to be 100% (or at least top notch) perfect.

Currently I use this RegEx
PHP Code:
preg_match('/^[^\W][a-zA-Z0-9_]+(\.[a-zA-Z0-9_]+)*\@[a-zA-Z0-9_]+(\.[a-zA-Z0-9_]+)*\.[a-zA-Z]{2,4}$/'$string
Next to that, I am, ofcourse, going to split it with explode() on the @ and then check the subdomain. (example;
info@markernst.com » markernst.com)

Do you guys think this is pretty safe?
__________________
"Life is a bitch, take that bitch on a ride"
Send a message via MSN to ReSpawN
ReSpawN is offline  
Reply With Quote
Old 12-30-2007, 11:18 PM   #2 (permalink)
La Vida es Sueño
Advanced Programmer Top Contributor 
 
Wildhoney's Avatar
 
Join Date: Sep 2007
Location: Oldham
Posts: 2,280
Thanks: 90
Wildhoney is on a distinguished road
Default

To start us off, you probably want {2,6} at the end because of the .org.uk and .museum extensions. It seems to function pretty well for me, though.
__________________
The man who comes back through the Door in the Wall will never be quite the same as the man who went out.
Send a message via AIM to Wildhoney Send a message via MSN to Wildhoney Send a message via Yahoo to Wildhoney
Wildhoney is offline  
Reply With Quote
Old 12-31-2007, 12:22 AM   #3 (permalink)
Alan @ CIT
Member of the Month
The Frequenter
Member of the Month Top Contributor 
 
Alan @ CIT's Avatar
 
Join Date: Apr 2005
Location: South UK
Posts: 483
Thanks: 51
Alan @ CIT is on a distinguished road
Default

Out of interest, why would you need such a stringent e-mail address check? Assuming that you want it to be a correct e-mail address so that you can e-mail your users, it might be worth implementing an e-mail confirmation system where you e-mail your new registrations and they then click the link to confirm their e-mail. This would catch the people who just enter junk but regex valid email addresses (ie, bill@microsoft.com) when registering.

Unfortunately, a problem I ran across recently was users using sites like MintEmail - Disposable/Temporary Email Address (temporary 4hour throwaway e-mail addresses) when registering - short of banning all these domains I have yet to find a solution to this.

Alan
Send a message via MSN to Alan @ CIT
Alan @ CIT is offline  
Reply With Quote
Old 12-31-2007, 03:00 AM   #4 (permalink)
The Frequenter
 
Join Date: Dec 2007
Location: In my basement
Posts: 386
Thanks: 47
Aaron is on a distinguished road
Default

Why go so far to check to make sure the e-mail is correct?

There is only so far you can go until it is just a bother to users.

I suggest reading some articles people have made on image protection, you would find them interesting, and valid to this subject.


If you want to be a wise ass, check to make sure the domain they are registering is actually a domain. This can go farther than regex.
Send a message via MSN to Aaron
Aaron is offline  
Reply With Quote
Old 12-31-2007, 10:06 AM   #5 (permalink)
Alan @ CIT
Member of the Month
The Frequenter
Member of the Month Top Contributor 
 
Alan @ CIT's Avatar
 
Join Date: Apr 2005
Location: South UK
Posts: 483
Thanks: 51
Alan @ CIT is on a distinguished road
Default

The main reason for ensuring a correct / working e-mail address is for marketing. A valid e-mail address is like gold nowadays whether you plan on selling the addresses, sending out adverts in your usual newsletter or just as a future resource.

One effective way of acheiving this and one I plan on using more in the future is to scrap login names completely and have users login using their e-mail address / password. If you want to take this one further, you can send a randomly generated password to the e-mail account on registration rather than let the user choose their own. This way your mailing list is going to be about as accurate as it can be.

But... as usual - those lovely users of ours have solved this problem already: :)

Bugmenot.com - login with these free web passwords to bypass compulsory registration

Alan
Send a message via MSN to Alan @ CIT
Alan @ CIT is offline  
Reply With Quote
Old 12-31-2007, 03:35 PM   #6 (permalink)
The Addict
 
Join Date: Nov 2007
Posts: 264
Thanks: 2
TlcAndres is on a distinguished road
Default

Here I've compiled a list of the most popular dispoable emails it's already in an array for easy use...it'll be easy enough to check the email's domain against the array.

PHP Code:
$bannedEmails = array(
                    
'cosmorph.com',
                    
'10minutemail.com',
                    
'dodgeit.com',
                    
'dontreg.com',
                    
'e4ward.com',
                    
'gishpuppy.com',
                    
'haltospam.com',
                    
'jetable.org',
                    
'kasmail.com',
                    
'mailexpire.com',
                    
'maileater.com',
                    
'mailinator.com',
                    
'mailnull.com',
                    
'mintemail.com',
                    
'mintmail.com',
                    
'mytrashmail.com',
                    
'nobulk.com',
                    
'nospamfor.us',
                    
'pookmail.com',
                    
'shortmail.net',
                    
'sneakemail.com',
                    
'spam.la',
                    
'spambob.com',
                    
'spambox.us',
                    
'spamday.com',
                    
'spamfree24.org',
                    
'spamhole.com',
                    
'spaml.com',
                    
'spmagourmet.com',
                    
'tempemail.net',
                    
'tempinbox.com',
                    
'temporaryinbox.com',
                    
'willhackforfood.biz',
                    
'willselfdestruct.com',
                    
'wuzupmail.net',
                    
'6url.com',
                    
'greensloth.com',
                    
'mailmoat.com',
                    
'spammotel.com',
                    
'emailias.com',
                    
'zoemails.com',
                    
'netmails.com',
                    
'xents.com',
                    
'mailshell.com',
                    
'4warding.com',
                    
'walala.org',
                    
'ipoo.org',
                    
'2prong.com',
                    
'spamex.com',
                    
'bugmenot.com',
                    
'despam.it',
                    
'wh4f.org',
                    
'emailwarden.com',
                    
'blockfilter.com',
                    
'yopmail.com',
                    
'litepost.us',
                    
'pourri.fr',
                    
'disposeaMail.com',
                    
'slaskpost.de',
                    
'sofort-mail.de',
                    
'mailexpire.com',
                    
'spamfree24.org',
                    
'spamfree24.eu',
                    
'spamfree24.net',
                    
'spamfree24.info',
                    
'spamfree24.de',
                    
'disposable-email.com',
                    
'footard.com',
                    
'theanonymousemail.com',
                    
'oneoffemail.com',
                    
'notyetemail.com',
                ); 
TlcAndres is offline  
Reply With Quote
Old 12-31-2007, 03:50 PM   #7 (permalink)
Alan @ CIT
Member of the Month
The Frequenter
Member of the Month Top Contributor 
 
Alan @ CIT's Avatar
 
Join Date: Apr 2005
Location: South UK
Posts: 483
Thanks: 51
Alan @ CIT is on a distinguished road
Default

Thanks for that Andres, I'll be making use of your list in future :)

Alan.
Send a message via MSN to Alan @ CIT
Alan @ CIT is offline  
Reply With Quote
Old 01-01-2008, 01:22 AM   #8 (permalink)
La Vida es Sueño
Advanced Programmer Top Contributor 
 
Wildhoney's Avatar
 
Join Date: Sep 2007
Location: Oldham
Posts: 2,280
Thanks: 90
Wildhoney is on a distinguished road
Default

That was on Digg's front-page the other day, wasn't it? As part of a bigger article. I remember! I don't mind signing up too much so as long as it's actually worth it. Making me sign up for some trivial and pathetic reason just doesn't cut it with me, and I am often very cautious as to giving them my e-mail address.

Talking of which though, concerning the code, I only check for the basic email structure. I'm not so particular as to craft an extensive regex string because at the end of the day, it could still be a false email address. There is a function called checkdnsrr but I remember having some problems with that. You'll really need to check both MX and A records, as relying on the MX record being present is not a good idea, I found. For whatever reason, I am not sure on the specifics.

The best way is to really enforce users to activate their account. That way at least the email address has to be a valid email address. Whether that's a spam address (such as the notorious mail.ru spam), is immaterial because that's the responsibility for another part of the system, though predominantly that responsibility lies at the fingers of the users and the administrators.
__________________
The man who comes back through the Door in the Wall will never be quite the same as the man who went out.
Send a message via AIM to Wildhoney Send a message via MSN to Wildhoney Send a message via Yahoo to Wildhoney
Wildhoney is offline  
Reply With Quote
Old 01-01-2008, 05:31 PM   #9 (permalink)
The Frequenter
 
ReSpawN's Avatar
 
Join Date: Nov 2007
Location: Netherlands
Posts: 460
Thanks: 49
ReSpawN is on a distinguished road
Default

Long one, so here we go.

Quote:
Originally Posted by Alan @ CIT View Post
Out of interest, why would you need such a stringent e-mail address check? Assuming that you want it to be a correct e-mail address so that you can e-mail your users, it might be worth implementing an e-mail confirmation system where you e-mail your new registrations and they then click the link to confirm their e-mail. This would catch the people who just enter junk but regex valid email addresses (ie, bill@microsoft.com) when registering.

Unfortunately, a problem I ran across recently was users using sites like MintEmail - Disposable/Temporary Email Address (temporary 4hour throwaway e-mail addresses) when registering - short of banning all these domains I have yet to find a solution to this.

Alan
I've indeed heard of it. Honestly, I couldn't care less if the program was used. My site / CMS and others will be used to gain more free roam over the personal page. Thus confirming your account with an activation key. Second, if programs like MintEmail are used, I can also filter those out.

People who use my CMS want HONEST customers/people. If you don't like it, don't register.

Quote:
Originally Posted by Wildhoney View Post
To start us off, you probably want {2,6} at the end because of the .org.uk and .museum extensions. It seems to function pretty well for me, though.
Thanks, I ran across it a few days ago and I've already implemented it.

Quote:
Originally Posted by Aaron View Post
Why go so far to check to make sure the e-mail is correct?
There is only so far you can go until it is just a bother to users.
I suggest reading some articles people have made on image protection, you would find them interesting, and valid to this subject.
If you want to be a wise ass, check to make sure the domain they are registering is actually a domain. This can go farther than regex.
Because I need to send activation keys? Else there is NO point in registering. Image protection has already been implemented. I am a wiseass. I am using the checkdnsrr function on a A and MX basis. For the administrator, this might slow the CMS, so he can either choose to use it uppon installation, or not. It can also be turned on/off in the admin as well.

Quote:
Originally Posted by TlcAndres View Post
Here I've compiled a list of the most popular dispoable emails it's already in an array for easy use...it'll be easy enough to check the email's domain against the array.

PHP Code:
$bannedEmails = array(
                    
'cosmorph.com',
                    
'10minutemail.com',
                    
'dodgeit.com',
                    
'dontreg.com',
                    
'e4ward.com',
                    
'gishpuppy.com',
                    
'haltospam.com',
                    
'jetable.org',
                    
'kasmail.com',
                    
'mailexpire.com',
                    
'maileater.com',
                    
'mailinator.com',
                    
'mailnull.com',
                    
'mintemail.com',
                    
'mintmail.com',
                    
'mytrashmail.com',
                    
'nobulk.com',
                    
'nospamfor.us',
                    
'pookmail.com',
                    
'shortmail.net',
                    
'sneakemail.com',
                    
'spam.la',
                    
'spambob.com',
                    
'spambox.us',
                    
'spamday.com',
                    
'spamfree24.org',
                    
'spamhole.com',
                    
'spaml.com',
                    
'spmagourmet.com',
                    
'tempemail.net',
                    
'tempinbox.com',
                    
'temporaryinbox.com',
                    
'willhackforfood.biz',
                    
'willselfdestruct.com',
                    
'wuzupmail.net',
                    
'6url.com',
                    
'greensloth.com',
                    
'mailmoat.com',
                    
'spammotel.com',
                    
'emailias.com',
                    
'zoemails.com',
                    
'netmails.com',
                    
'xents.com',
                    
'mailshell.com',
                    
'4warding.com',
                    
'walala.org',
                    
'ipoo.org',
                    
'2prong.com',
                    
'spamex.com',
                    
'bugmenot.com',
                    
'despam.it',
                    
'wh4f.org',
                    
'emailwarden.com',
                    
'blockfilter.com',
                    
'yopmail.com',
                    
'litepost.us',
                    
'pourri.fr',
                    
'disposeaMail.com',
                    
'slaskpost.de',
                    
'sofort-mail.de',
                    
'mailexpire.com',
                    
'spamfree24.org',
                    
'spamfree24.eu',
                    
'spamfree24.net',
                    
'spamfree24.info',
                    
'spamfree24.de',
                    
'disposable-email.com',
                    
'footard.com',
                    
'theanonymousemail.com',
                    
'oneoffemail.com',
                    
'notyetemail.com',
                ); 
Pretty solid! Thanks for the advise.
Quote:
Originally Posted by Alan @ CIT View Post
The main reason for ensuring a correct / working e-mail address is for marketing. A valid e-mail address is like gold nowadays whether you plan on selling the addresses, sending out adverts in your usual newsletter or just as a future resource.

One effective way of achieving this and one I plan on using more in the future is to scrap login names completely and have users login using their e-mail address / password. If you want to take this one further, you can send a randomly generated password to the e-mail account on registration rather than let the user choose their own. This way your mailing list is going to be about as accurate as it can be.

But... as usual - those lovely users of ours have solved this problem already: :)

Bugmenot.com - login with these free web passwords to bypass compulsory registration

Alan
On the first paragraph, Alan knows EXACTLY what I am talking about. The second paragraph goes on about using an email address as a login feature. I like it, but it's not solid as well. More safe, yes, but it directly displays the email address to the system and can be used for any number of hacks.

BugMeNot.com is a fair site, for sure. I've heard about it but never tended to use it. It's English and most Dutchmen are really against registering on foreign sites. I on the other hand, am not.

Quote:
Originally Posted by Wildhoney View Post
That was on Digg's front-page the other day, wasn't it? As part of a bigger article. I remember! I don't mind signing up too much so as long as it's actually worth it. Making me sign up for some trivial and pathetic reason just doesn't cut it with me, and I am often very cautious as to giving them my e-mail address.

Talking of which though, concerning the code, I only check for the basic email structure. I'm not so particular as to craft an extensive regex string because at the end of the day, it could still be a false email address. There is a function called checkdnsrr but I remember having some problems with that. You'll really need to check both MX and A records, as relying on the MX record being present is not a good idea, I found. For whatever reason, I am not sure on the specifics.

The best way is to really enforce users to activate their account. That way at least the email address has to be a valid email address. Whether that's a spam address (such as the notorious mail.ru spam), is immaterial because that's the responsibility for another part of the system, though predominantly that responsibility lies at the fingers of the users and the administrators.
Actication and the checkdnsrr has been implemented. Once again thanks for the advice Adam.


Mark
__________________
"Life is a bitch, take that bitch on a ride"
Send a message via MSN to ReSpawN
ReSpawN is offline  
Reply With Quote
The Following User Says Thank You to ReSpawN For This Useful Post:
Alan @ CIT (01-01-2008)
Old 01-01-2008, 05:35 PM   #10 (permalink)
The Addict
 
Join Date: Nov 2007
Posts: 264
Thanks: 2
TlcAndres is on a distinguished road
Default

On a note so relevant note..

I'm personally annoyed by BugMeNot and am writing a function to scan for my site on bugmenot and take the users their and ban them.
TlcAndres is offline  
Reply With Quote
Old 01-01-2008, 05:44 PM   #11 (permalink)
The Frequenter
 
ReSpawN's Avatar
 
Join Date: Nov 2007
Location: Netherlands
Posts: 460
Thanks: 49
ReSpawN is on a distinguished road
Default

When you finish up that one, post it!
__________________
"Life is a bitch, take that bitch on a ride"
Send a message via MSN to ReSpawN
ReSpawN is offline  
Reply With Quote
Old 01-01-2008, 09:53 PM   #12 (permalink)
The Addict
 
Join Date: Nov 2007
Posts: 264
Thanks: 2
TlcAndres is on a distinguished road
Default

PHP Code:

function getCURL($address)
{
    
$ch curl_init();
    
curl_setopt($chCURLOPT_URL$address);
    
curl_setopt($chCURLOPT_RETURNTRANSFERtrue);
    
$output curl_exec($ch);
    
curl_close($ch);
    return 
$output;
}

function 
strip_data($data)
{
    
$srcArr = array('$\<(.*?)>$','$\<\\/(.*?)>$','/(Username)/ ');
    
$repArr = array('','','');
    return 
preg_replace($srcArr,$repArr,$data);
}    

function 
scanBug($address)
{
    
$data getCURL('www.bugmenot.com/view/' $address);
    if(!empty(
$data))
    {
        
$regex '/\<th>Username <\\/th><td>(.*?)<\\/td>/';
        if(
preg_match_all($regex,$data,$matches))
        {
            
$matches array_map('strip_data',$matches);
            return 
$matches[1];
        }
        else
        {
            return 
false;
        }
    }
    else
    {
        return 
false;
    }

That should work nicely for retrieving the bugmenot.com username and passwords. you can decide what to do with the data from there.

Notes
-Bugmenot.com generates different pages for yeah.com - Only the best links ... and foo.com
-I haven't actually tested the getCURL function because I don't have the extension installed, I was using file_get_contents from a test file.
-it returns an array containing all the usernames

Last edited by TlcAndres : 01-02-2008 at 04:17 AM.
TlcAndres is offline  
Reply With Quote
Old 01-02-2008, 12:06 AM   #13 (permalink)
La Vida es Sueño
Advanced Programmer Top Contributor 
 
Wildhoney's Avatar
 
Join Date: Sep 2007
Location: Oldham
Posts: 2,280
Thanks: 90
Wildhoney is on a distinguished road
Default

I've had a stab at it as well. Call it the official TalkPHP Bug Me Not Killer! With added cyanide !

php Code:
<?php

    class TalkPHP_BugMeNotKiller
    {
        private $m_szAddress;
       
        private $m_aUsernames;
        private $m_aPasswords;
       
        public function __construct($szAddress)
        {
            $this->m_aUsernames = array();
            $this->m_aPasswords = array();
           
            $this->m_szAddress = sprintf('http://www.bugmenot.com/view/%s', $szAddress);
        }
       
        public function execute()
        {
            $pCurl = curl_init($this->m_szAddress);
           
            curl_setopt($pCurl, CURLOPT_FOLLOWLOCATION, true);
            curl_setopt($pCurl, CURLOPT_RETURNTRANSFER, true);
            curl_setopt($pCurl, CURLOPT_USERAGENT, 'TalkPHP.com BugMeNot Killer');
           
            $aData = curl_exec($pCurl);
           
            preg_match_all('~<tr><th>.+?\s?</th><td>(?P<username>.+?)</td></tr>\n\s*<tr><th>.+?\s?</th><td>(?P<password>.+?)</td></tr>~im', $aData, $aMatches);
           
            foreach($aMatches['username'] as $szUsername)
            {
                $this->m_aUsernames[] = $szUsername;
            }
               
            foreach($aMatches['password'] as $szPassword)
            {
                $this->m_aPasswords[] = $szPassword;
            }
           
            return $this;
        }
       
        public function hasAccounts()
        {
            if(empty($this->m_aUsernames))
            {
                return false;
            }
           
            return true;
        }
       
        public function getUsernames()
        {
            return $this->m_aUsernames;
        }
       
        public function getPasswords()
        {
            return $this->m_aPasswords;
        }
    }
   
    $pBug = new TalkPHP_BugMeNotKiller('sitepoint.com');
    $pBug->execute();
   
    if($pBug->hasAccounts())
    {
        echo 'Usernames: ' . implode(', ', $pBug->getUsernames());
        echo '<br />';
        echo 'Passwords: ' . implode(', ', $pBug->getPasswords());
    }

?>
__________________
The man who comes back through the Door in the Wall will never be quite the same as the man who went out.
Send a message via AIM to Wildhoney Send a message via MSN to Wildhoney Send a message via Yahoo to Wildhoney
Wildhoney is offline  
Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT. The time now is 03:29 PM.

 
     

Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.1.0
Inactive Reminders By Icora Web Design