Question

I have this relatively simple regex for usernames

// Enforce that username has to be 3-100 characters, alphanumeric, and first character a letter.
// Possibility without begin/end characters and i: [a-z][a-z0-9@.+-_]{2,100}
// Allow for simple email usernames in the future...
return !!preg_match('#^[a-zA-Z][a-zA-Z0-9@.+-_]{2,100}$#', trim($username));

Which, unfortunately, allows these XSS-ready test strings:

'angle<bracket',
'angle>bracket',
'html<script>inside',

And I have no idea why since they already should explicitly be disallowed by the regex.

Here is a running test case:

http://ideone.com/od7dj

Anyone know why angle brackets are being allowed by a regex that doesn’t explicitly allow for them? Am I supposed to escape one of those characters (.+-) as literals?

Answer 1

I think it’s because of this: [+-_]

You are including all chars between ‘+’ and ‘_’, try changing the order to [+_-] (putting the dash at the end) or escape the dash.