Email Validation
Email Validation in PHP
Validate email addresses in PHP with filter_var, regex fallback rules and safe handling for forms, imports and logs. This reference is written for developers who need practical validation behavior, reviewable rules and safe examples rather than copied snippets with no explanation.
Recommended workflow
| Step | Why it matters |
|---|---|
| Prefer built-ins first | PHP's email filter is a safer baseline than a copied pattern for most apps. |
| Add product rules after syntax | Blocked domains, disposable checks and uniqueness belong in separate steps. |
| Redact logs | Validation failures can be counted without storing every submitted address. |
| Test imports separately | Bulk CSV input needs memory, encoding and duplicate handling too. |
Starter snippet
$email = trim($_POST['email'] ?? '');
$isValid = filter_var($email, FILTER_VALIDATE_EMAIL) !== false;Review checks
- Trim input before validation.
- Keep database uniqueness rules case-aware and documented.
- Return user-safe messages instead of regex internals.
- Do not send verification email until syntax and rate limits pass.
Common mistakes
- Using a complex regex when filter_var is enough.
- Logging raw POST bodies on validation failure.
- Mixing disposable-domain policy with syntax checks.
Validation should help users correct input while protecting systems from bad data. Keep syntax checks, product policy, security review and deliverability checks separate.
Related Formalint references
Continue with Email Regex Php Guide, Php Runtime Guide, Csv Utf8 Encoding Guide.