Character Questions

[TheMayhem]

My users are exploiting some bad coding on my part as far as username's and the available characters they can use. How can I take on a registration script basically a variable called

$username

and outside of determining the amount of characters entered, prohibit them from using any characters but
Alphabet, Numbers, _, -, ', and spaces. In addition they found another way to make my script not function completely correctly by having the first letter of their username or the last be a space. How can I disable so both the first and last letters of whatever they type in can not be a space or an underscore?

[bpat1434]

$username = $_POST['username'];

if($username{1}==' ' || $username{strlen($username)} == ' ')
{
  // Username starts or ends with space....
}
else
{
  if(ereg("^[a-zA-Z0-9_\-\' ]*$", $username))
  {
    // Username is fine...
  }
  else
  {
    // Username is invalid
  }
}

Of course, you can always do this with one simple regex:

// "\x20" is the Hex value of a space....
$pattern = "^[a-z0-9]{1}([-a-z0-9_'\x20]){3,63}([a-z0-9]){1}$"
if(ereg($pattern, $username))
{
  // Username is valid
}
else
{
  // Username is invalid
}

This option limits your usernames to be at least 5 characters long, but no more than 65. Their name can start with any letter or number, and end with a letter or number, and contain spaces and the like in between, but not on the ends....

I'm pretty sure that will work. It's an adaptation of the usernote by bobocop