Question

I am using preg_match_all in php to check the characters in the username and password before i add them to the database, but I can’t seem to get it to work the way I want. Here is what I have right now:

preg_match_all(USERNAME_PATTERN,$username,$usernameMatches);
preg_match_all(PASSWORD_PATTERN,$password,$passwordMatches);

Here are the patterns, defined as constants:

/*Username and Password Patterns*/
define("USERNAME_PATTERN","[-*_a-z0-9A-Z.]");
define("PASSWORD_PATTERN","[_a-z0-9A-Z]");

I don’t know what is wrong with it. Its suppose to check to see if the username has anything other than a-z, A-Z, 0-9, the dash, the astrisk,the underscore, and a period. The password is the same as the username.

Here is the code I use to check:

if ($usernameMatches == 0){
echo("Bad characters in username<br />");
}

The password is the same.

Answer 1

There are several issues with your code.

1. Your regexes only match a single character.
2. There are no begin and end anchors in your regex.
3. Make sure you instantiate the matches array before calling preg_match_all()
4. Your regex should be surrounded with a / (or other valid char).
5. Check for a non-match by checking that the array is empty, not by checking if it’s equal to zero. There are many type/value checking gotchas in php and it’s best to avoid them.

Try this:

/*Username and Password Patterns*/
define("USERNAME_PATTERN","/^[-*_a-z0-9A-Z.]+$/");
define("PASSWORD_PATTERN","/^[_a-z0-9A-Z]+$/");

$usernameMatches = array();
$passwordMatches = array();

preg_match_all(USERNAME_PATTERN,$username,$usernameMatches);
preg_match_all(PASSWORD_PATTERN,$password,$passwordMatches);

if (empty($usernameMatches)){
    echo("Bad characters in username<br />");
}

if (empty($passwordMatches)){
    echo("Bad characters in password<br />");
}

BTW: Your code could simplified by simply using preg_match() instead of preg_match_all(). Something like this should work as well as your code:

/*Username and Password Patterns*/
define("USERNAME_PATTERN","/^[-*_a-z0-9A-Z.]+$/");
define("PASSWORD_PATTERN","/^[_a-z0-9A-Z]+$/");

if (!preg_match(USERNAME_PATTERN, $username)) {
    echo("Bad characters in username<br />");
}
if (!preg_match(PASSWORD_PATTERN, $password)) {
    echo("Bad characters in password<br />");
}