Would this regular expression work?

Question

^([a-zA-Z0-9!@#$%^&*|()_\-+=\[\]{}:;\"',<.>?\/~`]{4,})$

Would this regular expression work for these rules?

• Must be atleast 4 characters
• Characters can be a mix of alphabet (capitalized/non-capitalized), numeric, and the following characters: ! @ # $ % ^ & * ( ) _ - + = | [ { } ] ; : ' " , < . > ? /

It's intended to be a password validator. The language is PHP.

Answer 1

Regex buddy is your friend.

Answer 2

You forgot the comma (,) and full stop (.) and added the tilde (~) and grave accent (`) that were not part of your specification. Additionally just a few characters inside a character set declaration have to be escaped:

^([a-zA-Z0-9!@#$%^&*()|_\-+=[\]{}:;"',<.>?/~`]{4,})$

And that as a PHP string declaration for preg_match:

'/^([a-zA-Z0-9!@#$%^&*()|_\\-+=[\\]{}:;"\',<.>?\\/~`]{4,})$/'

Answer 3

I noticed that you essentially have all of ASCII, except for backslash, space and the control characters at the start, so what about this one, instead?

^([!-\[\]-~]{4,})$

Answer 4

You are extra escaping and aren't using some predefined character classes (such as \w, or at least \d).

Besides of that and that you are anchoring at the beginning and at the end, meaning that the regex will only match if the string starts and ends matching, it looks correct:

^([a-zA-Z\d\-!$@#$%^&*()|_+=\[\]{};,."'<>?/~`]{4,})$

If you really mean to use this as a password validator, it reeks of insecurity:

• Why are you allowing 4 chars passwords?
• Why are you forbidding some characters? PHP can't handle some? Why would you care? Let the user enter the characters he pleases, after all you'll just end up storing a hash + salt of it.

Answer 5

Impressive. Should work. Jeez..

Answer 6

Yes?

Honestly, what are you asking for? Why don't you test it?

If, however, you want suggestions on improving it, some questions:

1. What is this regex checking for?
2. Why do you have such a large set of allowed characters?
3. Why don't you use /\w/ instead of /0-9a-zA-Z_/?
4. Why do you have the whole thing in ()s? You don't need to capture the whole thing, since you already have the whole thing, and they aren't needed to group anything.

What I would do is check the length separately, and then check against a regex to see if it has any bad characters. Your list of good characters seems to be sufficiently large that it might just be easier to do it that way. But it may depend on what you're doing it for.

EDIT: Now that I know this is PHP-centric, /\w/ is safe because PHP uses the PCRE library, which is not exactly Perl, and in PCRE, \w will not match Unicode word characters. Thus, why not check for length and ensure there are no invalid characters:

if(strlen($string) >= 4 && preg_match('[\s~\\]', $string) == 0) {
  # valid password
}

Alternatively, use the little-used POSIX character class [[:graph:]]. It should work pretty much the same in PHP as it does in Perl. [[:graph:]] matches any alphanumeric or punctuation character, which sounds like what you want, and [[:^graph:]] should match the opposite. To test if all characters match graph:

preg('^[[:graph:]]+$', $string) == 1

To test if any characters don't match graph:

preg('[[:^graph:]]', $string) == 0

Answer 7

No. That regular expression would not work for the rules you state, for the simple reason that $ by default matches before the final character if it is a newline. You are allowing password strings like "1234\n".

The solution is simple. Either use \z instead of $, or apply the D modifier to the regex.