tags:

views:

270

answers:

4

The below regex requires that the password has 1 number, 1 char (upper or lower) and is a minimum of 8 in length. But if I type in a special char it returns false. I don't want to require a special char, but i want to allow it in this context. How can I alter this regex to allow a special char?

Regex.IsMatch(Password, "^(?=.*[0-9])(?=.*[a-zA-Z])\w{8,}$")
+4  A: 
Regex.IsMatch(Password, "^(?=.*[0-9])(?=.*[a-zA-Z]).{8,}$")
chaos
This permits spaces in the password. I suspect that is not desired.
hobodave
Why would spaces be any less desirable in a password than, say, ampersands?
chaos
hobodave
Still not really feeling it. What's the theory there, that if someone has a space at the beginning or end of their password, they must have typoed? That's what password confirmations are for.
chaos
I'd go so far as to say that it's *important* to support spaces in a password, because people normally don't think of them as usable, which means they inherently increase password strength more than other characters.
chaos
You're following the DAMN principle. Developer As every MaN. Yes, you and I would probably utilize spaces at the beginning or end of a password. However, the vast majority of computer users are <insert P.C. synonym for clueless>. Users may be copy/pasting their password from a file, which may include an errant space. I agree with permitting whitespace within a password. Yet there are valid arguments against permitting leading/trailing whitespace.
hobodave
Ahh, there we go. That was what I was looking for: a valid argument. :) I wouldn't always be guided by that one, but it's definitely worth thinking about. +1 for your answer. :)
chaos
+6  A: 

Changing "\w" to "." should do it:

Regex.IsMatch(Password, "^(?=.*[0-9])(?=.*[a-zA-Z]).{8,}$")

\w matches "word" characters, which won't normally match special characters (depending on your definition of "special" and the language you're using).
. will match any character except newline

Greg
"Special character" usually means punctuation, or maybe punctuation and whitespace. It's from the same geekspeak dialect that calls digits "numbers" and letters, "characters".
Alan Moore
+4  A: 

Why not do 3 separate checks, that way you can clearly check if the password meets the required parameters but without having to maintain a large Regex?

if (Regex.IsMatch(Password, "\d") &&
    Regex.IsMatch(Password, "\w") &&
    Password.length >= 8) //psuedo-code

This won't restrict any characters. It checks that the password has at least one word character, at least one number, and is at least 8 characters long.

tj111
Definately cleaner.
Doesn't match special chars though.
Doesn't match them, but doesn't need to. It doesn't *exclude* them either. Of course, the plusses are superfluous.
chaos
nice, however I wourd refactor Regex.IsMatch(Password, "\d") into a method called "ContainsAtLeastOneWordCharector()" etc so as it make it clear what is going on.
Ian Ringrose
+3  A: 

Toran, if you do not want to permit whitespace in your password use the following:

Regex.IsMatch(Password, "^(?=.*[0-9])(?=.*[a-zA-Z]\S{8,}$")
hobodave