CodeIgniter strong password policy with compulsory uppercase/lowercase letters and digits

Question

I want to require the user to choose a strong password with at least one uppercase letter and one digit. How do I enforce this policy when validating a form with CodeIgniter?

Answer 1

Extend the default Form_validation class and create a custom validation rule for your custom password validation.

To extend the default class you need to create a MY_Form_validation class and put it into your application/libraries/MY_Form_validation.php. Here's an example:

<?php defined('BASEPATH') OR exit('No direct script access allowed');

/**
 * Extension of CI's default form validation library.
 *
 * @see system/libraries/Form_validation.php
 */
class MY_Form_validation extends CI_Form_validation {

    /**
     * Custom password validation rule.
     *
     * @param  string $pass Password to check.
     *
     * @return bool       
     */
    public function check_pass($pass)
    {
        // It's a good practice to make sure each validation rule does
        // its own job. So we decide that this callback does not check
        // for the password field being required. If we need so, we just
        // prepend the "required" rule. For example: "required|min_length[8]|check_pass"
        //
        // So we just let it go if the value is empty:
        if (empty($pass))
        {
            return TRUE;
        }

        // This sets the error message for your custom validation
        // rule. %s will be replaced with the field name if needed.
        $this->set_message('check_pass', 'Password needs to have at least one uppercase letter and a number.');

        // The regex looks ahead for at least one lowercase letter,
        // one uppercase letter and a number. IT'S NOT TESTED THOUGH.
        return (bool) preg_match('/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).+$/', $pass);
    }

}

With this custom class in place, the check_pass validation rule will be available to your controllers when setting rules.

If you're too lazy to add this custom class or you already have the validation function implemented somewhere else, you might want to use custom validation callbacks by prepending callback_ to the name of existing functions and use them as validation rules. See validation callbacks for more on this.

I don't recommend the latter approach though as it messes up with where validation rules reside. There are some cases that we MUST use custom callbacks that not reside in the validation class, outside those cases (which is not yours) all rules better be in your custom class.

P.S. Also consider this: