Depending on the language and regex interpreter options, this isn't as strict as it could be since it might accept unicode numbers. For the paranoid, this would be better:
^[0-9]{5}(-[0-9]{4})?$
Edit: And security issues aside, there's really no need for a capturing group on the last four digits, thus it could be:
How about chars in zip codes (afaik GB has chars in zip codes)?
Input validation is usually a UX fail because there will be for sure one thing you miss (traditional example: email address validation). Zip codes I'd rather don't check at all or check against a list of valid zip codes if really necessary.
ZIP codes are an American thing. ZIP codes are a specific system of postal codes. If you are talking about ZIP codes, it's American.
If you are validating an American address, you'd want to validate using something that validates a ZIP code. If you get a Canadian address, you'd want to validate against that (which also happens to make it simple to validate against the province as well).
And yes, if you shouldn't using the term ZIP codes and postal codes interchangeably and treating them the same way in your code.
I agree in general. I think it was just a contrived example though in interest of discussing security/validation. Their example was in context of US users (and US zip-codes don't deviate from the pattern, but yes you could go one step further and reference the zip-code against the state and address using an API).
Also, specifically on regex, I'd imagine \d is being used in places where validation against unicode would be buggy (whether in form validation or elsewhere). I think Java and JavaScript default to ASCII only though.
The UK Government (after OSM took off) started to open source and release more data. You can download[1] the database of most of the UK postcodes[2] and their latitude & longitude. So if you want to really verify a GB postcode, you can just check it against the list
Well, that's the thing, Canada doesn't have ZIP codes. ZIP codes are purely an American system. Canada has postal codes, and you can easily verify the format of them, as well as the location of Canadian postal codes. So if you know the person is in Canada, you simply check against a different set of rules.
