[Resolved] Regular Expressions for Password Validation

digitalflash

I'm trying to come up with a regular expression for password validation that encompasses the following rules:

A password must have between 6 and 15 characters.
It must be composed of letters or numbers, but no special characters or spaces.
It must include at least one uppercase AND one lowercase letter (i.e., a mixture).
It must contain at least one number that does not occupy either the first or the last position (i.e., it can have a number in the first or last position, but in that case it would have to have another number in a non-first or -last place position).

Here's the snippet I'm trying to build off of:

$password = $value;
         if(!ereg("^([a-zA-Z0-9]){6,15}$", $value))
         {
              print("error message text");
          }

This covers, I think, the first two conditions, but I don't know how to get at the last two. I'm new to regular expressions and am finding it hard to wrap my head around this. Any help will be greatly appreciated. Thanks.

mrhappiness

function check_pw($pass) {
	//check length (should be faster here as in regular expression)
	$len = strlen($pass);
	if ($len < 5 or $len > 16)
		return false;
	//check mixture of of upper and lowercase letters
	if (preg_match('%[a-z]+%', $pass) ^ preg_match('%[A-Z]+%', $pass))
		return false;
	//check forbidden characters
	if (!preg_match('%^[a-z0-9]+[0-9]+[a-z0-9]+$%i', $pass))
		return false;
	return true;	
}

digitalflash

I think I follow the if statement checking for a mixture of upper and lower case characters.

Any examples of how to get at item #4: it must contain at least one number that does not occupy either the first or the last position?

I think mostly I just need to find some examples of how these kinds of regular expressions are written so I can get the syntax down....in this case, something that says, strip off the first and last characters of the string and make sure there is a number in what is left of the string.

linus

Mrhappiness covered #4 in the last regex. %^{[a-z0-9]+[0-9]+[a-z0-9]+$%i} would mean "at least one letter/number followed by at least one number followed by at least one letter/number." So his function should do it for you. However instead of using a regex to make sure the case is varied, like he does:

    //check mixture of of upper and lowercase letters
    if (preg_match('%[a-z]+%', $pass) ^ preg_match('%[A-Z]+%', $pass))
        return false;

...you can use simple string functions, which should be marginally faster:

  // check mixture of upper and lowercase letters
  if (
    ($pass == strtoupper($pass)) || // i.e. it's all uppercase
    ($pass == strtolower($pass)) // i.e. it's all lowercase
  )
    return false;

digitalflash

Thanks, that was the ticket!