Checking String for illegal characters using regular expression

Question

I want to check a for any illegal character using the following regular expression in PHP. Essentially, I want to allow only alphanumeric and underscore (_). Unfortunately the follow piece of code does not seem to work properly. It should return true if there is any illegal character in the string $username. However, it still allows any character in the string. Any idea what is wrong with the regular expression?

if ( !preg_match("/^[-a-z0-9_]/i", $username) )
{
    return true;
}

Thanks in advance.

Ben Blank · Accepted Answer · 2009-05-18 17:02:38Z

16

Your code checks to see if the first character is not valid. To check to see if any invalid characters exist, negate your character class rather than the function return and remove the anchor:

if ( preg_match("/[^-a-z0-9_]/i", $username) )
{
    return true;
}

You could also, of course, shorten it to /[^-\w]/ ("word" characters are letters, numbers, and the underscore), or even just /\W/ if you don't want to allow dashes.

answered May 18, 2009 at 17:02

Ben Blank

57k28 gold badges133 silver badges164 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Pianosaurus Over a year ago

This solution is better than the ones matching entire strings, since preg_match can return true as soon as it encounters a non-allowed character. It won't matter much on something as short as a username, though.

SharpC · Accepted Answer · 2017-11-21 20:42:26Z

2

If $username only has alphanumeric and underscore it will return TRUE

if (preg_match("/^[a-z0-9_]+$/i", $username) )
{
    return true;
}

edited Nov 21, 2017 at 20:42

SharpC

7,5544 gold badges53 silver badges45 bronze badges

answered May 18, 2009 at 17:06

arahaya

1,0409 silver badges11 bronze badges

Comments

Zoredache · Accepted Answer · 2009-05-18 17:03:47Z

1

Your expression matches only 1 character. Try /^[-a-z0-9_]+$/i the '+' matches more then 1 character and the '$' is the end of line anchor

answered May 18, 2009 at 17:03

Zoredache

39.9k9 gold badges50 silver badges63 bronze badges

Comments

Pianosaurus · Accepted Answer · 2009-05-18 17:03:52Z

1

You need to anchor it at the end too, instead of just checking the first character. Try "/^[-a-z0-9_]*$/i" instead.

answered May 18, 2009 at 17:03

Pianosaurus

5,7982 gold badges22 silver badges16 bronze badges

Comments

Michael Kolczynski · Accepted Answer · 2009-05-18 17:04:39Z

0

You have no repeater for one. You need a repeater such as +. As far as I can see without executing it, you check start of line and one character matching a-zA-Z0-9 and _ but nothing following that first character.

answered May 18, 2009 at 17:04

Michael Kolczynski

Collectives™ on Stack Overflow

Checking String for illegal characters using regular expression

5 Answers 5

1 Comment

Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

1 Comment

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related