Email with spaces is allowed

I just got a customer last night who used "2 tanners [email protected]" (not the actual email, but same effect) to create an account and buy something. Needless to say he won't be getting his confirmation emails but is there a way to prevent that on the create account form?

This is on zc 1.3.0.1 with no modifications to the create account page.

is there a way to prevent that on the create account form?

If you wish to prevent spaces with emails, (which is a good choice to make),

in your includes/modules/create_account.php file,

find these two lines:

$email_format = zen_db_prepare_input($_POST['email_format']);

replace with:

$email_format = zen_db_prepare_input(trim($_POST['email_format']));

This should prevent to use useless empty spaces from queries. :thumbsup:

It would seems I forgot some lines on the same file mentionned above.

Then, find:

$email_address = zen_db_prepare_input($_POST['email_address']);

replace with:

if (isset($_GET['email_address']) || isset($_POST['email_address'])) {
  $email_address = (isset($_POST['email_address']) && !empty($email_address)) ? zen_db_prepare_input(trim($_POST['email_address'])) : "";
  }

Then, find:

'customers_email_address' => $email_address,

replace with:

'customers_email_address' => trim($email_address),

/* Optional */

If you're using PHPbb to create user accounts within Zen Cart,

find:

$phpBB->phpbb_create_account($nick, $password, $email_address);

replace with:

$phpBB->phpbb_create_account($nick, $password, trim($email_address));

/* End of optional */

Then, find:

$db->Execute("insert into " . TABLE_COUPON_EMAIL_TRACK . " (coupon_id, customer_id_sent, sent_firstname, emailed_to, date_sent) values ('" . $coupon_id ."', '0', 'Admin', '" . $email_address . "', now() )");

replace with:

$db->Execute("insert into " . TABLE_COUPON_EMAIL_TRACK . " (coupon_id, customer_id_sent, sent_firstname, emailed_to, date_sent) values ('" . $coupon_id ."', '0', 'Admin', '" . trim($email_address) . "', now() )");

Then, find:

$db->Execute("insert into " . TABLE_COUPON_EMAIL_TRACK . " (coupon_id, customer_id_sent, sent_firstname, emailed_to, date_sent) values ('" . $insert_id ."', '0', 'Admin', '" . $email_address . "', now() )");

replace with:

$db->Execute("insert into " . TABLE_COUPON_EMAIL_TRACK . " (coupon_id, customer_id_sent, sent_firstname, emailed_to, date_sent) values ('" . $insert_id ."', '0', 'Admin', '" . trim($email_address) . "', now() )");

These should be all. :thumbsup:

It might be better to check out the email-address validation code so that the user is informed that there is a problem, rather than blindly deleting spaces.... Fewer places to touch code, too.

And, technically, it should already be rejecting addresses containing spaces. Might be something awry with the regex...

Um ... looks to me like the RFC standard allows spaces in email names (but not domains).

ie: this is valid:
"first name"@mydomain.com

This is allowed by Zen Cart at the present time.