Securing Strong Password with PHP

Question

I am trying to check if a user has created a password containing characters (including +, -, = characters) OR / AND. How can i do this?

function check_password($str)
{

   if (!preg_match ("/[&@<>%\*\,\^!#$%().]/i", $str))

    {
        $this->form_validation->set_message('check_password', 'Your password should contain a number,letter,and special characters"');
        return FALSE;
    }
    else
    {
        return TRUE;
    }

} 

Thank.

Answer 1

My suggestion for verifying the strength of a password is to break each requirement that you have into separate regular expressions, in particular:

   $regexs = array(
                 '/[0-9]+/',  // Numbers
                 '/[a-z]+/',  // Lower Case Letters
                 '/[A-Z]+/',  // Upper Case Letters
                 '/[+-=]+/',  // Your list of allowable symbols.
   );

Initialize counter 0. For each regular expression, check to see if it matches. If so, increase the counter by 1. Then return true if the counter is greater than 3 (or 4, if you want them to have a really really strong password), otherwise return false.

, , .

Answer 2

. , , ( ):

(?:[^0-9A-z]|[0-9])

Answer 3

I recommend looking in a different direction. If you want to impose a restriction, just require it to be longer. As already mentioned, the use of characters is likely to make the user forget the password and never return to your site. For maximum security, send the following comic on the registration page: http://xkcd.com/936/