Is this PHP email validation comprehensive and complete? It might be a bit redundant, and I'm not experienced enough to wrap it all into one function. But,
I'm aiming for unicode email adresses and a quick loose but secure validation. How can I improve this?

note: I'm using PDO, so I'm mainly focusing on preventing HTML injection. Is this an issue ether way if I'm outputting user input in htmlspecialchars?

$email = "&lt;strong&gt;Bàt mâ'n&lt;/strong&gt;@çupærman.dc";

function isValid($email) {
    return !preg_match('/[^ ]+@[^ ]+\.[^ ]{2,7}/', $email);
}

$encoded_email = htmlspecialchars($email, ENT_COMPAT, 'UTF-8');
if (isValid($email)) {
    echo $encoded_email. " is not valid!";
} else {
    if ($encoded_email===$email) {
    echo $encoded_email. " is valid!";
    } else {
        echo $encoded_email. " is not valid!";
    }
}
Use filters

You are a lot better off just using the built in validation filters:

$email_a = 'joe@example.com';
$email_b = 'bogus';

if (filter_var($email_a, FILTER_VALIDATE_EMAIL)) {
    echo "This (email_a) email address is considered valid.";
}
if (filter_var($email_b, FILTER_VALIDATE_EMAIL)) {
    echo "This (email_b) email address is considered valid.";
}


Handling International email addresses

International domain names are not really UTF-8 - they are punycode encoded strings (ascii). A UTF-8 local name isn't considered valid by most servers - i.e.


foo@çupærman.dc valid (after converting the domain to punycode)
foo@xn--uprman-quaf.dc valid (this is the above puny code converted)
çupærman@foo.dc INvalid


if you just want to prevent injection - run the email address through striptags before processing; you could also follow this advice and use loose validation and simply send a mail to confirm the mail exists.