When your registration form is using a user ID that is the same as their email address, I'm somewhat concerned over spammers using the "User name is in use" as a means to validate the existence of an email, or if there are other concerns I need to know of for validation sake (for instance, converting CaMeLcAsE to lowercase seems to be the status-quo despite the RFC spec).

This question is not about OpenID.

  • 1
    Before you accept anyone's username or password, I strongly suggest you read this. You mention OpenID (and that you're not using it) which makes me suspect that you are aware, but I want to make this clear for other people why might come by that collecting usernames and passwords is generally something that's not nessesary in this day and age. Dec 15, 2010 at 21:31

3 Answers 3


You should make sure the email address is not only real but in the control of the registrant. Send an email to that address with an activation link inside. Make visiting that link a requirement for activating their account. That way you know the email is both real and in the control of the user.

One check you may want to consider making is checking the DNS records of the email address's domain name to make sure MX records are set up for that domain. This helps to weed out fake emails account like [email protected]. Just keep in mind that it is possible to setup your mail records in such a way that this check will fail for some legitimate email addresses. I've never had that problem but it is something to keep in mind.


They can only tell if it's a valid email address if that person has registered with your site, so it all depends on how popular your site gets.

I don't think that converting it to camelcase will change anything as they can easily convert to lower case or upper case if necessary.

Have you thought of putting a captcha on the site? Google's ReCaptcha is always a good one.


You could put a "flipper" around the captcha code (and the code that validates it).

See how Flickr and Forrst do it

  • I've been considering captcha, but I don't really want to run with that unless I have a spammer problem... anyone spamming my site would need to design a program specifically for my site. I'm sure there's questions on the site already regarding it's implementation that I could check out.
    – Incognito
    Dec 15, 2010 at 15:14
  • See original post - I've put some more suggestions Dec 15, 2010 at 15:38
  • @user1725 If you display any user generated content, don't be surprised if spammers do write an application specific to your site - they've done it for one of mine (and even updated it a couple of times as my heuristics improved) Dec 16, 2010 at 8:38

This is a non-issue if you return the same message for both of the following cases:

  • Invalid login/invalid pass
  • Valid login/invalid pass

It is generally a bad idea to tell a user that his login is valid but his pass is invalid: doing so allows an attacker to find valid logins.

Sorry, my mistake - if this is just a concern for registration then why not apply the same principle (share no information regarding account existence) and just let users re-register the account with the e-mail provided (chances are they've forgotten their password so instead of sending the new registration e-mail just send an e-mail with a link to reset the account password).

  • 1
    This is the registration process, not the sign in.
    – Incognito
    Dec 15, 2010 at 23:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.