Except that the HTML spec explicitly states just before that regex that what it checks is not whether it's a valid e-mail address, and that it intentionally rejects valid e-mail address.
echo "banned command $cmd: $output"
This is non-portable if there is any possibility that these variables contain backslashes.