You are absolutely correct. Any detainting regex should allow @ - and . which are non-word characters that are found in valid email addresses. But only in specific forms. Numbers and underscores will match \w in RE, so those don't need to be considered separately.