Have you ever thought to send a security code to the email the user put in the sign up form just to say him later "the password must contains at least 8 characters, etc." and ask him to fill the form again from scratch?

Who is so dumb to put the input check in this order? Honeywell.

- The email is correct?
- Ok, send a code and ask to confirm it
- The password meets the requirements?
- No, ask to confirm the email again just for fun.

I'll just ignore the waste of server resources to send N * Number of users emails for no reason.