In the documentation I read:
use \A and \Z to match the start and end of the string, ^ and $ match the start/end of a line
I am going to apply a regular expression to check username (or e-mail is the same) submitted by user. Which expression should I use with validates_format_of in model? I can't understand the difference: I've always used ^ and $ ...
-
If you're depending on the regular expression for validation, you always want to use \A and \Z. ^ and $ will only match up until a newline character, which means they could use an email like
me@example.com\n<script>dangerous_stuff();</script>and still have it validate, since the regex only sees everything before the\n.My recommendation would just be completely stripping new lines from a username or email beforehand, since there's pretty much no legitimate reason for one. Then you can safely use EITHER \A \Z or ^ $.
-
The start and end of a string may not necessarily be the same thing as the start and end of a line. Imagine if you used the following as your test string:
my
name
is
AndrewNotice that the string has many lines in it - the
^and$characters allow you to match the beginning and end of those lines (basically treating the\ncharacter as a delimeter) while\Aand\Zallow you to match the beginning and end of the entire string.
0 comments:
Post a Comment