that should do the trick
^[a-zA-Z]{5}[0-9]{4}[a-zA-Z]$
Answer from Romain on Stack OverflowTurns out, when you add edge cases, it gets slightly more complicated, so I'll provide an answer to this one:
[&?]var=((?:%[\dA-Fa-f]{2}|[^&%]){10})(?:&|$)
See the demo
Basically, this will match "var" at any point in the parameter process, without matching "othervar=", it will make sure to grab url encoded characters as a single char, and will make sure that it isn't grabbing a partial "var" (say the information is 11, or 20 characters long, this will not match that string, as it checks for another parameter after it, or the end of the string).
Breakdown:
[&?]var=-var=must occur after an&or a?%[\dA-Fa-f]{2}- match a hexcode after a percentage sign (to get url-encoded characters as a single character).[^&%]- anything not a percent or ampersand(?:%[\dA-Fa-f]{2}|[^&%]){10}- non capture group, get the hexcode or not percent or ampersand exactly 10 times((?:%[\dA-Fa-f]{2}|[^&%]){10})- capture what I explained in the last point(?:&|$)- end at an ampersand or the end of the string or line
You can group the request string values for var
>>> import re
>>> s
'http://127.0.0.1:8000/?var=fea40u7b94&xyz=ewewv7832h'
>>> re.findall('=(\w{10})',s)
['fea40u7b94', 'ewewv7832h']
>>> re.findall('var=(\w{10})',s)
['fea40u7b94']
You may use a second lookahead:
^(?!\d+$)(?![a-zA-Z]+$)[a-zA-Z\d]{10}$
See the regex demo and the Regulex graph:

Details
^- start of string(?!\d+$)- a negative lookahead that makes sure the whole string is not composed of just digits(?![a-zA-Z]+$)- the whole string cannot be all letters[a-zA-Z\d]{10}- 10 letters or digits$- end of string.
Try this:
(?=^.{10}$)^([a-z]+\d[a-z0-9]*|\d+[a-z][a-z0-9]*)$
Demo
Explanation:
(?=^.{10}$)^([a-z]+\d[a-z0-9]*|\d+[a-z][a-z0-9]*)$
(?=^.{10}$) # there's exactly 10 characters following
^( | )$ # we match the entire string, containing either:
[a-z]+\d[a-z0-9]* # letters, followed by a number, followed by alphanumerics, or
\d+[a-z][a-z0-9]* # numbers, followed by a letter, followed by alphanumerics
I don't know what environment you are using and what engine. So I assume PCRE (typically for PHP)
this small regex does exact what you want: ^(?i)(?!\s)[a-z\d ]{1,10}$
What's going on?!
- the
^marks the start of the string (delete it, if the expression must not match the whole string) - the
(?i)tells the engine to be case insensitive, so there's no need to write all letter lower and upper case in the expression later - the
(?!\s)ensures the following char won't be a white space (\s) (it's a so called negative lookahead) - the
[a-z\d ]{1,10}matches any letter (a-z), any digit (\d) and spaces () in a row with min 1 and max 10 occurances ({1,10}) - the
$at the end marks the end of the string (delete it, if the expression must not match the whole string)
Here's also a small visualization for better understanding.

Debuggex Demo
Try this: [0-9a-zA-Z][0-9a-zA-Z ]{0,9}
The {x,y} syntax means between x and y times inclusive. {x,} means at least x times.
To match a string that contains only those characters (or an empty string), try
"^[a-zA-Z0-9_]*$"
This works for .NET regular expressions, and probably a lot of other languages as well.
Breaking it down:
^ : start of string
[ : beginning of character group
a-z : any lowercase letter
A-Z : any uppercase letter
0-9 : any digit
_ : underscore
] : end of character group
* : zero or more of the given characters
$ : end of string
If you don't want to allow empty strings, use + instead of *.
As others have pointed out, some regex languages have a shorthand form for [a-zA-Z0-9_]. In the .NET regex language, you can turn on ECMAScript behavior and use \w as a shorthand (yielding ^\w*$ or ^\w+$). Note that in other languages, and by default in .NET, \w is somewhat broader, and will match other sorts of Unicode characters as well (thanks to Jan for pointing this out). So if you're really intending to match only those characters, using the explicit (longer) form is probably best.
There's a lot of verbosity in here, and I'm deeply against it, so, my conclusive answer would be:
/^\w+$/
\w is equivalent to [A-Za-z0-9_], which is pretty much what you want (unless we introduce Unicode to the mix).
Using the + quantifier you'll match one or more characters. If you want to accept an empty string too, use * instead.
