5

I am building a user registration form using C# with .NET. I have a requirement to validate user entered password fields. Validation requirement is as below.

  1. It should be alphanumeric (a-z , A-Z , 0-9)
  2. It should accept 6-10 characters (minimum 6 characters, maximum 10 characters)
  3. With at least 1 alphabet and number (example: stack1over)

I am using a regular expression as below.

^([a-zA-Z0-9]{6,10})$

It satisfies my first 2 conditions. It fails when I enter only characters or numbers.

Cœur
  • 37,241
  • 25
  • 195
  • 267
Madhu
  • 147
  • 1
  • 2
  • 11
  • 7
    Why, why, why, are you setting a maximum allowed length for a password? – Damien_The_Unbeliever Feb 03 '10 at 07:45
  • 3
    I'll take Damien's comment one step further: Why are you (or rather, the people giving you the requirements) limiting the password to alphanumeric characters? A good password has non-alphanumerics in it. Do they actively *want* people to use bad passwords? Try to educate the people giving you these requirements. – T.J. Crowder Feb 03 '10 at 07:49
  • 1
    but our requirement is like that only – Madhu Feb 03 '10 at 07:57
  • 4
    Maybe they're doing SSO to a multitude of systems and the mainframe only allows ten characters for the password. Who knows? Who cares? Just answer the doggone question already :-) – paxdiablo Feb 03 '10 at 08:18

3 Answers3

9

Pass it through multiple regexes if you can. It'll be a lot cleaner than those look-ahead monstrosities :-)

^[a-zA-Z0-9]{6,10}$
[a-zA-Z]
[0-9]

Though some might consider it clever, it's not necessary to do everything with a single regex (or even with any regex, sometimes - just witness the people who want a regex to detect numbers between 75 and 4093).

Would you rather see some nice clean code like:

if not checkRegex(str,"^[0-9]+$")
    return false
val = string_to_int(str);
return (val >= 75) and (val <= 4093)

or something like:

return checkRegex(str,"^7[5-9]$|^[89][0-9]$|^[1-9][0-9][0-9]$|^[1-3][0-9][0-9][0-9]$|^40[0-8][0-9]$|^409[0-3]$")

I know which one I'd prefer to maintain :-)

paxdiablo
  • 854,327
  • 234
  • 1,573
  • 1,953
  • Do you mean all these in a single expression as below validationexpression="^([a-zA-Z0-9]{6,10})$[a-zA-Z][0-9]" – Madhu Feb 03 '10 at 08:32
  • 1
    No. I mean something like: if (!str.match(re1)) return false; if (!str.match(re2)) return false; return str.match(re3); - that's three separate invocations with three separate regexes. – paxdiablo Feb 03 '10 at 09:10
7

Use positive lookahead

^(?=.*[a-zA-Z])(?=.*[0-9])[a-zA-Z0-9]{6,10}$

Look arounds are also called zero-width assertions. They are zero-width just like the start and end of line (^, $). The difference is that lookarounds will actually match characters, but then give up the match and only return the result: match or no match. That is why they are called "assertions". They do not consume characters in the string, but only assert whether a match is possible or not.

The syntax for look around:

  • (?=REGEX) Positive lookahead
  • (?!REGEX) Negative lookahead
  • (?<=REGEX) Positive lookbehind
  • (?<!REGEX) Negative lookbehind
Amarghosh
  • 58,710
  • 11
  • 92
  • 121
  • Thanks for your reply. But its not working. Try changing the order you inserted the values. It wont work properly – Madhu Feb 03 '10 at 08:09
  • Wow, I didn't hit upon this. Imo, it works as expected, at least in Python) – Rorick Feb 03 '10 at 08:36
  • try some text starting with numbers. If you use alphabets in the beginning of the word, it works as you expected. But when you start the same with numbers, it doesnt.(I am using .net with c#) Thanks for your patience. – Madhu Feb 03 '10 at 08:58
  • @Madhu I tested it with expresso and it is working fine for strings starting with numbers. (don't have .net development environment with me). Post an example that fails with it and we might be able to tell you whats the issue. – Amarghosh Feb 03 '10 at 10:13
0
string r = @"^(?=.*[A-Za-z])(?=.*[0-9])[A-Za-z0-9]{6,10}$";
Regex x = new Regex(r);
var z = x.IsMatch(password);

http://www.regular-expressions.info/refadv.html

http://www.regular-expressions.info/lookaround.html

Brock Hensley
  • 3,617
  • 2
  • 29
  • 47