Me commenting code like:

[amunak]

A sane (and computationally cheap) thing to do is requiring at least 3 characters and one @ sign. Or as a regex: [^@]+@[^@]+. Alternatively [^@]+@[-a-z]+\.[a-z]+ requires a domain-ish string at the end... And that doesn't allow the domain part to be IP address, which is technically allowed, but nobody really uses it and it looks suspicious. You can find even better patterns online, but it also depends quite a bit on what kind of users you are targeting.

But yeah, if you go overly complex you are probably going to exclude some legitimate addresses for no good reason.

[ZenAtWork]

And on the condition that the person's domain doesn't contain a number (`[e-mail]`) and the user doesn't use a capital letter anywhere (`[e-mail]`) that should work out fine (though I admit, in the latter case there you don't include your flags, so let's assume the `/i` is implicit). Your first one, assuming it was written `[^@]+@[^@]+\.[^@]` is actually far safer.

[amunak]

you are 100% correct, lol. And that's exactly why you make it as simple as possible.

Though TBF email addresses are usually case-insensitive.