I think I have been sspring cleaning test suites too much this week and gone a bit test case crazed! But it sparked a little challenge idea.
How many ways can you test an email input field?
The weirder and more creative the answer, the better!
(Think aliens trying to register for a newsletter, or emails for Egyptian mummies made of only hieroglyphics)
Serious answers welcome too - I am intrigued to see how wild and thorough a collective test suite could get.
I’ll go first
My go to test is always cat pictures
and if I need to escalate an issue - baby bear pictures
what really need to test is asd.asd@asd.thisDotIsImportant.asd
Have you tried the big list of naughty strings? That’s always good place to start for me
Try these steps to reproduce and let me know if you find any bugs along the way…
- Go to the email input field in your desktop / mobile browser
- Enter a valid input
- Press the associated call to action (submit, save etc.)
- Turn off your internet
a. On mobile, this can be done by turning off WiFi and mobile data
b. On desktop, open the network tab - Wait atleast 20 seconds before re-instating the connection
After re-instating the connection look for bugs in the UI (are you able to see the expected input confirmation), network tab, logs, database etc.
Apart from normal test cases, you can try:
- Try email with all capital letters
- Try email with single capital letters
- If deletion is possible, try with the email of the deleted user
- Check with numbers like abc+1@xyz.com or abc+2@xyz.com
- Check SQL syntax in the input field
- Try SQL injection
- While submitting the email, you can also open the network console and check in the payload whether the email is going with or without encryption. For better security purposes, emails and passwords should be encrypted
- Instead of @ use text “at the rate of”
- Error message on incomplete or invalid email
- Depending on the requirement, you can also check if the submit button is getting enabled on invalid or incomplete error messages as the “Submit” button is enabled only when the user enters a complete email
- You can also check for disposable email or temporary email
how about email with just Binary address: 01000011@1010110.1010
or Hexadecimal : 0x4F5C@0xABdomain.hex
- try a technically valid x@y . Dots in domains aren’t needed.
- is it saved and displayed elsewhere?
- align the input restrictions with the display restrictions?
- what factors influence the processing time?
- how good can I automate actions with it in a specific framework?
- what happens at different errors? Are they shown? How?
- what is about the underlying API? Does it need authorization?
- what related cookie data can I manipulate and what happens then?
- how accessible is for different people?
- how can I input data? Typing? Copy & past (context menu, shortcut)? Drag & drop?
- what buttons are there and what do they do?
- what happens when I press Enter, Esc or other keys?
- does it has inline helptext and how does this work?
- by who is it meant to be used?
- who is interested into getting what by implementing that field?
Hitting the back and refresh buttons after logging in. If you try to log in again with a different address, which user is validated?
Some ideas that can up while having the same conversation at work:
I see Cat pictures: Can you add a img html text string to the email and get the picture to show up on any linked systems?
Field is haunted : Does the email field fill itself with autofill even when autocomplete="off"
is set?
Time Traveller Test : Set system clock to the year 1900 or 3000 — does date validation or caching break?
Midnight Madness : Submit form exactly at 00:00 UTC. Does anything behave strangely (timers, campaign logic)?
Other people’s settings: Does the 3rd party password manager try and change any settings or inputs?
Bored Devs: Have the devs hidden any jokes or easter eggs?
I got to input all combination with alphanumeric into 256 characters or until reach input limit.
Just input all special characters.