Regex for simple password validation in PHP and Javascript

Question

I'm trying to validate a password with PHP and I want to use the same Regex with Javascript, In my PHP I'm getting error when I'm trying to use the following regex.(Warning: filter_var(): Compilation failed: range out of order in character class at offset 14)

/^[a-zA-Z0-9_-\]\[\?\/<~#`!@\$%\^&\*\(\)\+=\}\|:\";\',>\{]{4,20}$/

if (!filter_var($password,FILTER_VALIDATE_REGEXP, array("options"=>array("regexp"=>"/^[a-zA-Z0-9_-\]\[\?\/<~#`!@\$%\^&\*\(\)\+=\}\|:\";\',>\{]{4,20}$/")))){
    $errors .= "Please enter a valid password.";
}

I want the password to have 0-9,a-zA-Z and these characters ] [ ? / < ~ # ! @ $ % ^ & * ( ) + = } | : " ; ' , > { space plus `

I want to use the regex for front and back ends.

Don't limit passwords and use the proper methods to hash and verify passwords with PHP. If you're using a PHP version less than 5.5 you can use the password_hash() compatibility pack. — Jay Blanchard
– Jay Blanchard, Commented Sep 22, 2015 at 18:26
I'm hashing the password in my user class, $password = password_hash($user_passwd, PASSWORD_DEFAULT); — Junius L
– Junius L, Commented Sep 22, 2015 at 18:29
The only problem was the hyphen, right? Place it at the end of the character class, and in JS and PHP you won't have to escape it. Use ^[a-zA-Z0-9_\]\[?\/<~#`!@$%^&*()+=}|:\";\',>{ -]{4,20}$. I see your regex is missing a space, I added it, too. However, the hyphen is missing from your list of allowed characters. Something does not click here. — Wiktor Stribiżew
– Wiktor Stribiżew, Commented Sep 22, 2015 at 18:47
Does it mean my regex works for you? Shall I post an answer then? — Wiktor Stribiżew
– Wiktor Stribiżew, Commented Sep 22, 2015 at 19:11

webdeb · Accepted Answer · 2015-09-22 19:25:06Z

2

Take a look at this "modular" regEx

/(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,}/.test(password)

this password should have:

(?=.*\d) = digits
(?=.*[a-z]) = small letters
(?=.*[A-Z]) = cap. letters
.{8,} = at least 8 chars long

Special chars part: taken from one of the answers above thanks @stribizhev

(?=.*[?\/<~#`!@$%^&*()+=}|:\";\',>{ -]) = special chars

So you end up with:

/(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[?\/<~#`!@$%^&*()+=}|:\";\',>{ -])/.test(password)

to force minimal lenght .{n,} n = lenght

/(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[?\/<~#`!@$%^&*()+=}|:\";\',>{ -]).{8,}/.test(pass)

edited Sep 22, 2015 at 19:25

answered Sep 22, 2015 at 18:36

webdeb

13.3k5 gold badges32 silver badges44 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Junius L Over a year ago

I want to include the other mentioned characters.

webdeb Over a year ago

just add them as additional condition (?=.*[%_])

webdeb Over a year ago

@TurnTheTables to test your regex you can use the console in chrome dev-tools ;)

Wiktor Stribiżew · Accepted Answer · 2015-09-22 19:17:11Z

0

You can use

^[a-zA-Z0-9_\]\[?\/<~#`!@$%^&*()+=}|:\";\',>{ -]{4,20}$
                                             ^^

Note the "smart" position of the hyphen at the end of the character class, and in JS and PHP you won't have to escape it.

I see your regex is missing a space, I added it, too.

Note that inside a character class, a lot of special characters are treated as literals, and do not have to be escaped. I removed escape symbols from those that do not need escaping.

answered Sep 22, 2015 at 19:17

Wiktor Stribiżew

631k41 gold badges502 silver badges632 bronze badges

1 Comment

Wiktor Stribiżew Over a year ago

If you found my answer helpful, please also consider upvoting.

Martyn Shutt · Accepted Answer · 2015-09-22 19:53:59Z

0

/^[a-zA-Z0-9_\]\[\?\/\<\~\#\`\@\$%\^&\*\(\)\+=\}\|:\";\'\,>\{]{4,20}$/

You had an un-escaped hyphen in your first character set, and you needed to escape the comma.

Edit: Escaped a few other metacharacters.

edited Sep 22, 2015 at 19:53

answered Sep 22, 2015 at 18:29

Martyn Shutt

1,71418 silver badges26 bronze badges

2 Comments

Junius L Over a year ago

Thanks but you are missing the hyphen.

Martyn Shutt Over a year ago

@Turn The Tables I took it out intentionally because it looked like an error. I used the list of characters you posted underneath your code, which did not include the hyphen. You might want to update your original question.

Collectives™ on Stack Overflow

Regex for simple password validation in PHP and Javascript

3 Answers 3

3 Comments

1 Comment

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

1 Comment

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related