What characters to limit when user enters an email?

Question

I have a backend that does not support emoji characters in all of its fields, so I want to block them directly in the frontend application. I'm in the register section, and I want to limit the possible characters for the email field. I know that RFC 5322 specifies that many particularities can be found in those addresses, including special characters. Even emoji can be put there (link).

I'm using a whitelist to implement this block.

What character should I whitelist to support the common emails without falling into whitelisting every characters supported by email addresses?

Answer 1

The vast majority (probably over 99%) of the email addresses still use the pre-2012 rules described in Wikipedia:

The local-part of the email address may use any of these ASCII characters:

• uppercase and lowercase Latin letters A to Z and a to z;
• digits 0 to 9;
• printable characters others than letters and digit !#$%&'*+-/=?^_`{|}~;
• dot ., provided that it is not the first or last character unless quoted, and provided also that it does not appear consecutively unless quoted (e.g. John..Doe@example.com is not allowed but "John..Doe"@example.com is allowed);

So for starters, you can whitelist all ASCII characters; if you feel a little more fancy, you can use a regular expression, e.g. one of those listed here.

The HTML element input with type email, which is often used in web forms, uses the following regex for validation:

^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$

Yes, this does mean that letters diacritical marks like @JörgMittag's ö cannot be used: see this Regex101 example. Whether it's worth expanding the regex/character validation to non-ASCII characters depends on your user base. I see you're from Canada; there might be French-speaking users with accented letters in their names and email addresses. If those really need to be supported, check which characters your backend supports (e.g. all ISO-8859-1 characters) and just whitelist those.