How do I validate (or escape) the name field of a user so it won't break my email sending software?

Question

When sending a message I can have something like this to set the To field: (in Perl)

To: "$name" <$email>

In Perl I can validate the $email part with Email::Valid but how do I make sure the $name part accepts Unicode characters but cannot be tricked into sending to multiple addresses or doing some other nasty thing? e.g. This

$email = '[email protected]';
$name = 'Foo" <[email protected]>, "Bar';

seem to create a To field like this:

To: "Foo" <[email protected]>, "Bar" <[email protected]>

sending e-mails to two addresses.

Answer 1

use Email::Address qw();
use Encode qw(encode);

s{\R}{}g for $email, $name; # newlines be-gone
my $to = Email::Address->new($name => $email)->format;
print encode 'MIME-Header', $to;

Answer 2

There may not be a simple solution to this. I'd recommend a conservative solution by hand.

/\p{L}/

matches any unicode letter in any language. Feel free to add dots or dashes, dependent on the cultural background of your software.