Does WordPress allow an * in the email address field?

According to the codex for sanitize_email, “Allowed character regular expression: /[^a-z0-9+_.@-]/i.”

I did find that reference, but wasn’t entirely confident that I knew what it meant. It’s just letters numbers and these characters: _ . @ –
right?

I think so. Regex is magic (evil magic) to me. It may be that the plugin you’re using is not properly sanitizing email addresses.

Ok, thanks!

I’d personally say avoid using an asterisk in email addresses as generally they’re not considered valid characters and would fail many standard email checks. Best to avoid if you as a general rule of thumb.

Yeah, we’re not trying to. There are users signing up for a site with *** in the email address. Apparently if you add a new user via the WP admin it lets you do this. You can try it on any site. It’s weird behavior if you ask me. Is it this way because of being multilingual? Seems like there should be a way to turn this off.

According to the RFC, * is legal in the local part of an email address. https://tools.ietf.org/html/rfc5322#section-3.2.3