title: Valid Email Addresses - XSS and SQL Injection
body: <p>Since there are so many valid characters for email addresses, are there any <strong>valid</strong> email addresses that can in themselves be XSS attacks or SQL injections? I couldn't find any information on this on the web.</p>
  
  <blockquote>
    <p>The local-part of the e-mail address
    may use any of these ASCII characters:</p>
    
    <ul>
    <li>Uppercase and lowercase English letters (a–z, A–Z)</li>
    <li>Digits 0 to 9</li>
    <li>Characters ! # $ % &amp; ' * + - / = ? ^ _ ` { | } ~</li>
    <li>Character . (dot, period, full stop) provided that it is not the last
    character, and provided also that it does not appear two or
    more times consecutively (e.g. John..Doe@example.com).</li>
    </ul>
  </blockquote>
  
  <p><a href="http://en.wikipedia.org/wiki/E-mail_address#RFC_specification" rel="noreferrer">http://en.wikipedia.org/wiki/E-mail_address#RFC_specification</a></p>
  
  <p><strong>I'm not asking how to prevent these attacks</strong> (I'm already using parametrized queries and escaping/HTML purifier), this is more a proof-of-concept.</p>
  
  <p>The first thing that came to mind was <code>'OR 1=1--@gmail.com</code>, except that spaces are not allowed. Do all SQL injections require spaces?</p>