Below are simple regex that cover your criteria. But, you might want to be more restrictive, like user max length, password minimum length, etc...
// One or more; characters (case insensitive), numbers, or _
if (preg_match("/^[a-z0-9_]+$/i", $user_id)) {
// Good
} else {
// Bad
}
// At least two numbers, no length limit.
if (preg_match("/[0-9]{2,}/", $password)) {
// Good
} else {
// Bad
}