It might be a bit redundant, and I'm not experienced enough to wrap it all into one function. But,I'm aiming for unicode email adresses and a quick loose but secure validation. How can I improve this?note: I'm using PDO, so I'm mainly focusing on preventing HTML injection. Is this an issue ether way if I'm outputting user input in htmlspecialchars?$email = <strong>Bt m'n</strong>@uprman.dc;function isValid($email) {    return !preg_match('/[^ ]+@[^ ]+\.[^ ]{2,7}/', $email);}$encoded_email = htmlspecialchars($email, ENT_COMPAT, 'UTF-8');if (isValid($email)) {    echo $encoded_email.  is not valid!;} else {    if ($encoded_email===$email) {    echo $encoded_email.  is valid!;    } else {        echo $encoded_email.  is not valid!;    }}
Is this PHP email validation comprehensive and complete?
php
Use filtersYou are a lot better off just using the built in validation filters:$email_a = 'joe@example.com';$email_b = 'bogus';if (filter_var($email_a, FILTER_VALIDATE_EMAIL)) {    echo This (email_a) email address is considered valid.;}if (filter_var($email_b, FILTER_VALIDATE_EMAIL)) {    echo This (email_b) email address is considered valid.;}Handling International email addressesInternational domain names are not really UTF-8 - they are punycode encoded strings (ascii). A UTF-8 local name isn't considered valid by most servers - i.e.foo@uprman.dc valid (after converting the domain to punycode)foo@xn--uprman-quaf.dc valid (this is the above puny code converted)uprman@foo.dc INvalidif you just want to prevent injection - run the email address through striptags before processing; you could also follow this advice and use loose validation and simply send a mail to confirm the mail exists.