WARNING: “Never” Write A-Z
All instances of ranges like A-Z
or 0-9
that occur outside an RFC definition are virtually always ipso facto wrong in Unicode. In particular, things like [A-Za-z]
are horrible antipatterns: they’re sure giveaways that the programmer has a caveman mentality about text that is almost wholly inappropriate this side of the Millennium. The Unicode patterns work on ASCII, but the ASCII patterns break on Uniocode, sometimes in ways that leave you open to security violations. Always write the Unicode version of the pattern no matter whether you are using 1970s data or modern Unicode, because that way you won’t screw up when you actually use real Java character data. It’s like the way you use your turn signal even when you “know” there is no one behind you, because if you’re wrong, you do no harm, whereas the other way, you very most certainly do. Get used to using the 7 Unicode categories:
\pL
for Letters. Notice how \pL
is a lot shorter to type than [A-Za-z]
.
\pN
for Numbers.
\pM
for Marks that combine with other code points.
\pS
for Symbols, Signs, and Sigils. :)
\pP
for Punctuation.
\pZ
for Separators like spaces (but not control characters)
\pC
for other invisible formatting and Control characters, including unassigned code points.
Solution
If you just want a pattern, you want
^[\pL\pN]+$
although in Java 7 you can do this:
(?U)^\w+$
assuming you don’t mind underscores and letters with arbitrary combining marks. Otherwise you have to write the very awkward:
(?U)^[[:alpha:]\pN]+$
The (?U)
is new to Java 7. It corresponds to the Pattern class’s UNICODE_CHARACTER_CLASSES
compilation flag. It switches the POSIX character classes like [:alpha:]
and the simple shortcuts like \w
to actually work with the full Java character set. Normally, they work only on the 1970sish ASCII set, which can be a security hole.
There is no way to make Java 7 always do this with its patterns without being told to, but you can write a frontend function that does this for you. You just have to remember to call yours instead.
Note that patterns in Java before v1.7 cannot be made to work according to the way UTS#18 on Unicode Regular Expressions says they must. Because of this, you leave yourself open to a wide range of bugs, infelicities, and paradoxes if you do not use the new Unicode flag. For example, the trivial and common pattern \b\w+\b
will not be found to match anywhere at all within the string "élève"
, let alone in its entirety.
Therefore, if you are using patterns in pre-1.7 Java, you need to be extremely careful, far more careful than anyone ever is. You cannot use any of the POSIX charclasses or charclass shortcuts, including \w
, \s
, and \b
, all of which break on anything but stone-age ASCII data. They cannot be used on Java’s native character set.
In Java 7, they can — but only with the right flag.