I don't know how many times I typed my email so fast I forgot the dot in-between the domain and the TLD.I don't validate email address format anymore (Ok I check to make sure there is an at sign and a period after that).Now it is correctly showing me "Field can't be empty" when you leave the field empty.
If your client javascript is bypassed and script tags are posted to your form, will throw a unhandled exception. An email address is a string of a subset of ASCII characters separated into two parts by an @ symbol .The part before the @ sign is the local part of the address, and the part after the @ sign is a domain name to which the email message will be sent . For example a name like O'Reilly is perfectly valid input, but could cause a crash or worse if inserted unescaped into SQL. The best way to confirm an email address is to email the user, and get the user to reply by clicking on a link to validate that they have recieved the email (the way most sign-up systems work). You should prevent XSS exploits, SQL injection and so on by escaping correctly when inserting strings into a different language where some characters are "magic", eg, when inserting strings in HTML or SQL.