Should I use filter_var to validate email?

Question

I have a class that validates every input before I send it to the database layer. Note that my problem is not about escaping or anything. My database layer will handle the SQL Injection problem. All I want to do is validate if the email is valid or not because later that email might be used as a 'send to'. For instance, the user will recover access to his account through a link sent to the e-mail. I read a lot about filter_var and there are a bunch of people being against it and other bunch being in favor. Keeping the focus on 'I just want to validate email and not filter it for database or for html or XSS or whatever', is there a problem in using filter_var?

Answer 1

Yes, you should.

Using the standard library validation instead of a home brew one has multiple benefits:

1. Many eyeballs already seen the code (well, at least two) you will be using, hopefully with experience in email validation even before it's merged into a release.
2. It's unit tested.
3. Other people will use the same check and report bugs and you get these fixes for free on php updates.

However checking the format of an email address is only the first line of defense, if you really want to know that it's real or not, you will have to send a message to it.

Answer 2

Yes, you should use filter_var and this is how you can incorporate it :

if( filter_var( $email ,FILTER_VALIDATE_EMAIL ) ) {     /*      * Rest of your code      */ }