views:

222

answers:

3

I am trying to localize an existing app that has the following logic that tries to validate a password text box. I'm assuming that this will not work with languages with special characters that the user could type in the text box. Am I correct? I don't think that we want to restrict the user from typing non-English-type characters (i.e. arabic, chinese, etc.). Or, is there something I'm not understanding?

Regex ValidHex =
   new Regex("[A-Za-z1234567890_-]+", RegexOptions.IgnoreCase);
if (!ValidHex.IsMatch(e.Text))
{
   e.Handled = true;
}
+6  A: 

Don't store passwords!

Hash the password using a cryptographic hashing function and compare that.

Ben S
As much as I hate this type of response, Ben's right.
Joe Behymer
@Ben S: where in the question is password storage mentioned?
Fredrik Mörk
Good advice in general, but also completely orthogonal to the question asked. He didn't say he was storing passwords, nor does his code snippet imply that he is.
Laurence Gonsalves
@Ben S: I'm with Fredrik - he's just trying to strengthen passwords, there's no storage mentioned.
JustLoren
@Frederik: that would be in the last sentence.
cdonner
A: 

Have you tried using \w instead of A-za-z? I'm betting that will get around localization issues.

JustLoren
+8  A: 

You can do like this to support unicode characters:

[\p{L}\p{N}_-]+

As a side note: is there any specific reason you need to limit what characters are allowed?

Fredrik Mörk
Exactly, if the user wants to add weird codes for security, why prevent that?
Henk Holterman
Agreed; there is never ever a good reason to limit (or even require) certain combinations of characters in passwords, for your users.
Noon Silk