The Perils of onpaste

I've written here before about the how pissed off I am at web sites that disable onpaste on <input> fields in forms. Last night I had an illustration of why people do it.

If people want to purchase PDFs or GPX routes for our Lake District walks at WalkLakes they have to register. We've got a form for that and, when they've filled it in, they are sent an email with a link in it which they have to click to confirm their email address. Nothing unusual there.

Now occasionally, despite my best efforts at validating the email address they enter¹, people put in an invalid email address so we get a delivery failure bounce. We get about one of those a week. If it's something obvious I email my best guess at the right address asking if it was them. Otherwise I delete it and move on.

So that sets the scene.

Last night a new user tries to register as (replacing "familyname" by the real family name) and we get a bounce. By the time I've got to this (I wasn't well yesterday) we've had an email via our contact form:

i seem to be struggling activating my registration. Can you help?

And here's the thing: it's from as per their registration. So I think about it and in the end I reply to but CCing suggesting that perhaps that's their real email address. And, yup, the email to chis. bounces again but this morning someone registers on the site using the chris. email address.

Anyway the reason I relate this tale is that it illustrates why people disable onpaste for email: they had mistyped it in the registration form but I suspect they then clicked Back and copied and pasted their email address into our contact form. So they ended up repeating the same error. Alternatively they made the same typo twice and again the (annoying to me) double entry of email address might have stopped this happening.

... not this this is going to make me change any of our web sites to disable onpaste and demand double entry of email addresses but I can see why some companies are tempted to do so.

1. I check the format is valid and that the domain is good. I am looking at extending this later - there's an API available that lets you do a tentative SMTP ping on their server which can help sometimes.