Question

With PHP, I’d like to use a preg_replace() filter for passwords such that the only characters available for passwords are US ASCII typable, minus control codes and NULL.

What’s the RegEx to achieve that which I can plugin to preg_replace()?

EDIT:

I’ve been advised to edit this question since I “get it” now and won’t be doing this terribly unpopular technique and will permit any typable character even ones I might not have on my keyboard, just as long as they aren’t control codes.

Answer 1

As others have said, don’t restrict the set of characters that are allowed in passwords. Just because your keyboard doesn’t have ä, å, or ö on it is no reason to stop those of us who do have them (or know how to type them anyhow) from using those letters. You’re going to be storing the password as a cryptographic hash anyhow (or at least as an encrypted string), aren’t you? If so, then it doesn’t matter whether your database can successfully/safely store the actual characters in the password anyhow, only the characters output by your crypto algorithm. (And if not, then storing passwords in plaintext is a far bigger problem than what characters the passwords may or may not contain – don’t do that!)

Your apparent intent to enforce your character set restrictions by silently stripping the characters you dislike rather than by telling the user “Try again and, this time, only use these characters: a, e, i, o, u.” makes your proposed method truly atrocious, as it means that if I attempt to use, say, the password fäîry (not incredibly secure, but should hold up against lightweight dictionary attacks), my actual password, unknown to me, will be fry (if your password is a three-letter word, straight out of the dictionary and in common use, you may as well not even bother). Ouch!