Make a validation with preg_match

Question

You can help me with this problem that I have, I would like to validate a password with specific requirements, which are: - It must contain a number, a capital letter and a special character. It must also be between 8 and 12 characters. Make the following pattern:

$special_chars = '!@#$%^&*()';
$pattern = "/[A-Z0-9{$special_chars}]{8,12}/";
$password = '$dsd%FG23X';
preg_match($pattern, $password, $matches);

But it does not work and I need to know what the correct pattern would be.

Possible duplicate of [Regex for password PHP](https://stackoverflow.com/q/8141125/1255289) — miken32, Oct 02 '18 at 22:53

mkveksas · Answer 1 · 2018-10-03T08:21:00.893

1

Try using the positive look-ahead. I've used regex101 to build the expression. First we check the required characters, then we check for the length. Here's what I came up with:

$special_chars = '!@#$%^&*(),.`';
$pattern = '/^(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[' . $special_chars . ']).*$/';

$password = '$dsd%FG23X';
preg_match($pattern, $password, $matches);

$password_validated = false;

if (strlen($password) >= 8 && strlen($password) < 50)
{
    if ( ! empty($matches)) {
        $password_validated = true;
    }
}

var_dump($password_validated);

Returns:

bool(true)

By the way, it's good to have a minimum password length, but it is a bad idea to have such a short maximum. You should allow the users the ability to have more complex characters, consider allowing something generous, like 50 characters. I generate my passwords with KeePass and they are usually at least 20 characters long.

Hope this helps!

edited Oct 03 '18 at 08:21

answered Oct 02 '18 at 22:48

mkveksas

171
8

But this will return a value for a string that is entirely lowercase. – miken32 Oct 02 '18 at 22:52
Looks like you have added the characters `[ | ] \ _ \`` too. Take a look at the ASCII table to see what `A-z` contains. – Casimir et Hippolyte Oct 02 '18 at 22:52
The problem is that if you remove the numbers equal returns the string. It is problematic, since I want a pattern that requires a number, a capital letter and a special character. – dimacros Oct 02 '18 at 22:55
@MarcosDavidHuarangaOrtega I've edited my answer, try now. – mkveksas Oct 02 '18 at 23:09
You can't check the string length if you allow any number of characters before your lookahead `(?=.{8,12})`. Also, variables aren't interpolated between single quotes. – Casimir et Hippolyte Oct 02 '18 at 23:14
@CasimiretHippolyte thanks for the feedback, I've edited my answer. – mkveksas Oct 02 '18 at 23:49
2

Now your code works. But the idea of my previous comment was to remove the useless `.*` before `(?=.{8,12})`, not the lookahead itself. – Casimir et Hippolyte Oct 03 '18 at 07:39
@CasimiretHippolyte thanks so much for your feedback, I've edit my answer with new changes. – mkveksas Oct 03 '18 at 08:21

Make a validation with preg_match

1 Answers1