This pattern would allow all characters that's not a digit or a-Z.

[^\da-zA-Z]

Regarding the \W it's a negated \w, which is the same as [A-Za-z0-9_]. Thus will \W be all characters that's not an english letter, digit or an underscore.

As I mentioned as a comment this is a great resource for learning regex. And here's a good site to test the regex.

If I correctly understand you want only this characters - backward slash,forward slash,single quote,double quotes to be disabled for you password validation. So here is the code:

 public function check_password($str){
    return ( preg_match('/^[^\\\"\'\/]+$/i', $str));
 }

I think this should look like that:

if(!preg_match('/^(?=.*\d)(?=.*[A-Za-z])[0-9A-Za-z!@#/', $password)) {
    echo 'the password does not meet the requirements!';
}

Between start -> ^
And end -> $
of the string there has to be at least one number -> (?=.*\d)
and at least one letter -> (?=.*[A-Za-z])
and it has to be a number, a letter or one of the following: !@#$% -> [0-9A-Za-z!@#$%]
and there have to be 8-12 characters -> {8,12}

As user557846 commented to your question, I would also suggest you to allow more characters, I usually (if i use a maximum) take at least 50 :)

btw, you might want to take a look at this regex tutorial

You could split your regex into different checks.

It will allow you to write more readable conditions and to display specific error messages. Although, regexp patterns will be easier to write and to understand.

i.e. :

$errors = array();
if (strlen($pass) < 8 || strlen($pass) > 16) {
    $errors[] = "Password should be min 8 characters and max 16 characters";
}
if (!preg_match("/\d/", $pass)) {
    $errors[] = "Password should contain at least one digit";
}
if (!preg_match("/[A-Z]/", $pass)) {
    $errors[] = "Password should contain at least one Capital Letter";
}
if (!preg_match("/[a-z]/", $pass)) {
    $errors[] = "Password should contain at least one small Letter";
}
if (!preg_match("/\W/", $pass)) {
    $errors[] = "Password should contain at least one special character";
}
if (preg_match("/\s/", $pass)) {
    $errors[] = "Password should not contain any white space";
}

if ($errors) {
    foreach ($errors as $error) {
        echo $error . "\n";
    }
    die();
} else {
    echo "$pass => MATCH\n";
}

Hope it helps.

Use the following pattern:

$strong_password = preg_match('/^(?=.[a-z])(?=.[A-Z])(?=.\d)(?=.[^A-Za-z\d])[\s\S]{6,16}$/', $string);

^                 --> start of string

(?=.*[a-z])       --> at least one lowercase letter 

(?=.*[A-Z])       --> at least one uppercase letter 

(?=.*\d)          --> at least one number 

(?=.*[^A-Za-z\d]) --> at least one special character

[\s\S]{6,16}      --> total length between 6 and 16

$                 --> end of string

You may need to escape some special characters used by the Regex Engine. And by the way, you could as well do that in one Go as shown below. Quick-Test Here.

<?php


    /*public static*/ function encPasswordCheckFailed($password) {
        // THIS READS:
        // IF THE PASSWORD DOES CONTAIN AN UPPER-CASE CHARACTER
        // AND ALSO DOES CONTAIN A LOWER-CASE CHARACTER
        // AND STILL DOES CONTAIN A NUMERIC CHARACTER
        // AND EVEN MORE, DOES CONTAIN ANY  OF THE SPECIFIED SPECIAL CHARACTERS 
        // RETURN FALSE OTHERWISE RETURN TRUE
        if (preg_match('/[A-Z]+/', $password) &&                    // CHECK FOR UPPERCASE CHARACTER
            preg_match('/[a-z]+/', $password) &&                    // AND CHECK FOR LOWERCASE CHARACTER
            preg_match('/[0-9]+/', $password)&&                     // AND CHECK FOR NUMERIC CHARACTER
            preg_match('/[\!@#$%\^&\*\(\)\-\+<>]+/', $password)     // AND CHECK FOR SPECIAL CHARACTER
        ) {
            return false;
        }

        return true;
    }

    var_dump( encPasswordCheckFailed("abcd123") );    //<== boolean true
    var_dump( encPasswordCheckFailed("abcD123") );    //<== boolean true
    var_dump( encPasswordCheckFailed("abcD1@23-") );  //<== boolean false

[\W]+ will match any non-word character.

but to match only the characters from the question, use this:

  $string="sadw$"
  if(preg_match("/[\[^\'£$%^&*()}{@:\'#~?><>,;@\|\\\-=\-_+\-¬\`\]]/", $string)){
   //this string contain atleast one of these [^'£$%^&*()}{@:'#~?><>,;@|\-=-_+-¬`] characters
  }

In no particular order:

• That hashing method is terrible and insecure. Hashes must be costly (slow) most of all, and they must contain a unique salt. Use password_hash, don't invent your own.

  • If that is the required hashing method: move away from it ASAP. But at the very least, utf8_encode is entirely superfluous, since you're only allowing ASCII characters to begin with and it won't do anything in that case.

• Don't validate strings you have already altered (here: after mysqli_real_escape_string).

• You're already using mysqli, use prepared statements rather than tedious and error prone escaping.
• Disallowing "special characters" in passwords makes them weaker, not stronger. Unless you have strong business reasons for this restriction (which legitimately may exist), don't limit the allowed character set.
• Use more functions to make your code more readable.
• Name your SQL columns, don't rely on the implicit order.
• Use DEFAULT values in your database table definitions instead of passing default values through the query, if possible.
• Check whether your SQL query succeeded (and/or use mysqli's exception error mode); presumably you have a UNIQUE constraint on the username, so the query may legitimately fail, and your code doesn't even know it.

function validateUsername($name) {
    return ctype_alnum($name) && strlen($name) >= 6;
}

function validatePassword($str) {
    return ctype_alnum($str) 
        && strlen($str) >= 8
        && preg_match('/[A-Z]/', $str)
        && preg_match('/[a-z]/', $str)
        && preg_match('/[0-9]/', $str);
}

function createUser(mysqli $db, $name, $password) {
    $stmt = $db->prepare('INSERT INTO `accounts` (`name`, `password`) VALUES (?, ?)');
    $stmt->bind_param('ss', $name, password_hash($password, PASSWORD_DEFAULT));
    return $stmt->execute();
}

if (!validateUsername($_POST['name'])) {
    echo 'Invalid name';
} else if (!validatePassword($_POST['password'])) {
    echo 'Invalid password';
} else if ($_POST['password'] !== $_POST['repeat_password']) {
    echo "Passwords don't match";
} else if (!createUser($db_link, $_POST['name'], $_POST['password'])) {
    echo 'Something went wrong';  // add better error handling here
} else {
    echo 'Account created';
}

Of course, you'll probably want to collect all the errors and output them next to the actual <input> elements when you inform the user about errors, instead of just failing on the first error that is produced. That's a bit too broad to tackle here though. And this could all be further improved with OOP or other larger architectural choices of course…

Try using the positive look-ahead. I've used regex101 to build the expression. First we check the required characters, then we check for the length. Here's what I came up with:

$special_chars = '!@#$%^&*(),.`';
$pattern = '/^(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[' . $special_chars . ']).*$/';

$password = '$dsd%FG23X';
preg_match($pattern, $password, $matches);

$password_validated = false;

if (strlen($password) >= 8 && strlen($password) < 50)
{
    if ( ! empty($matches)) {
        $password_validated = true;
    }
}

var_dump($password_validated);

Returns:

bool(true)

By the way, it's good to have a minimum password length, but it is a bad idea to have such a short maximum. You should allow the users the ability to have more complex characters, consider allowing something generous, like 50 characters. I generate my passwords with KeePass and they are usually at least 20 characters long.

Hope this helps!

Just add a starting anchor to your regex,

^(?=.*?[a-z])(?=.*?[A-Z])(?=.*?[0-9])

OR

^(?=.*?[a-z])(?=.*?[A-Z])(?=.*?[0-9]).*

Example:

$yourstring = 'Ab';
$regex = '~^(?=.*?[a-z])(?=.*?[A-Z])(?=.*?[0-9])~m';
if (preg_match($regex, $yourstring)) {
    echo 'Yes! It matches!';
    } 
else { 
echo 'No, it fails';
     }   // No, it fails

\$ already means "literal $" in PHP strings, so when put in a regex it just means "end of string".

Try \\\$ instead.

In your pattern, you need to use single quote instead of double ;)

So it will be like this

$reg_password = '/^[-_0-9a-záàâäãåçéèêëíìîïñóòôöõúùûüýÿæœÁÀÂÄÃÅÇÉÈÊËÍÌÎÏÑÓÒÔÖÕÚÙÛÜÝŸÆŒ0\d!@#$%^&*()_\+\{\}:\"<>?\|\[\];\',\.\/\x5c~]{6,30}$/i';