Question

I use this (almost) complex password verification:

function is_password($password) {
    return preg_match("^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{6,20}$", $password);
}

So it must contain:

• one digit from 0-9,
• one lowercase character,
• one uppercase character,
• at least 6 characters
• at most 20 characters

This does not seem to work. Whenever I type certain characters like e, t, o, j, c and b; the function returns true if allowed length is correct. So uppercase and digit is not being validated..

What am I doing wrong?

Answer 1

You forgot to use delimiters. Use this code instead:

return preg_match("/^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{6,20}$/", $password);

Or you may split each condition and use this code:

return mb_strlen($password)>=6 && mb_strlen($password)<=20
       && preg_match("/[a-z]+/", $password) && preg_match("/[A-Z]+/", $password)
       && preg_match("/[0-9]+/", $password);