0

I've written a number of regular expressions that sequentially check a password in PHP and have noticed a few anomalies. The regexs are intended to check that the password has at least one uppercase letter, lowercase letter, number and symbol in any position. The first three seem to be working fine as they are quite basic:

/[a-z]+/ (checks for at least one lowercase letter anywhere in string) /[A-Z]+/ (checks for at least one uppercase letter anywhere in string) /[0-9]+/ (checks for at least one number anywhere in string)

The regex for finding the symbol is quite extensive as it contains a large set of possible symbols that can be matched and also a set of symbols that shouldn't match:

/[\!\$\%\^\&\*\(\)\-\_\=\+\[\]\{\}\;\:\@\.\,\<\>\?\/\?\#]+[^\"\'\£]+/

This generally works except when a symbol is at the end of the string:

123$ABCxyz > this passes OK

123ABCxyz$ > this fails as the symbol is not recognised

Changing the regex to omit the last part and it works:

/[\!\$\%\^\&\*\(\)\-\_\=\+\[\]\{\}\;\:\@\.\,\<\>\?\/\?\#]+/

I assume that the regex in imposing a rule that fails due the last part. Running the NOT regex separately also fails.

[^\"\'\£]+/

I would assume that this statement would return true if none of the characters it targets are found.

Can anyone please explain why?

Many thanks, Kw

Kwangle
  • 349
  • 2
  • 15
  • 1
    If `/[\!\$\%\^\&\*\(\)\-\_\=\+\[\]\{\}\;\:\@\.\,\<\>\?\/\?\#]+/` works for you, what is the problem? – Wiktor Stribiżew Apr 21 '17 at 18:40
  • 1
    Allow users to use the [passwords / phrases](https://xkcd.com/936/) they desire. [Don't limit passwords.](http://jayblanchard.net/security_fail_passwords.html) – Jay Blanchard Apr 21 '17 at 18:48
  • You don't need to escape every character in a character class. – chris85 Apr 21 '17 at 18:53
  • @chris85, yes I realise that but was just being exhaustive. – Kwangle Apr 21 '17 at 18:54
  • So, what is the question? Explain what a regex means? – Wiktor Stribiżew Apr 21 '17 at 18:55
  • If you use https://regex101.com, or similar sites, it will tell you what's happening. I agree with Jay Blanchard that this is bad practice. Don't copy it from other sites. – KIKO Software Apr 21 '17 at 18:58
  • Its no a limitation so much as a stipulation. The regex merely checks that the password has a mixture of characters to create a more secure password. Any string that has at least one of the character types in any position passes the tests. – Kwangle Apr 21 '17 at 19:03

0 Answers0