First, I want to point out that if you own the form the data is coming from, the best way to restrict the input is to use the proper form elements (aka, number field)
<input type="number" name="size" min="0.01" max="9,999,999.99" step="0.01">
Whether "," can be entered will be based on the browser, but the browser will always give you the value as an actual number. (Remember that all form data must be validated/sanitized server side as well. Never trust the client)
Second, I'd like to expand on the other answers to a more robust (platform independent)/modifiable regex.
- You should surround the regex with ^ and $ to make sure you are matching against the whole number, not just a subset of it. ex
^<my_regex>$
- The right side of the decimal is optional, so we can put it in an optional group
(<regex>)?
- Matching a literal period and than any chain of numbers is simply
\.\d+
- If you want to insist the last number after the decimal isn't a 0, you can use
[1-9]
for "a non-zero number" so \.\d+[1-9]
- For the left side of the decimal, the leading number will be non-zero, or the number is zero. So
([1-9]<rest-of-number-regex>|0)
- The first group of numbers will be 1-3 digits so
[1-9]\d{0,2}
- After that, we have to add digits in 3s so
(,\d{3})*
- Remember ? means optional, so to make the , optional is just
(,?\d{3})*
Putting it all together
^([1-9]\d{0,2}(,?\d{3})*|0)(\.\d+[1-9])?$