-2

I am trying to check passwords to make sure they contain at least 1 uppercase, lowercase, and one number. I have looked into this but cannot find why every single time, it returns false. For example, I put in Thechedda123 , and it still returns false, and doesn't post to my database.

$password = $_GET["password"];
$regex = "^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[a-zA-Z\d]{8,}$";
$query="INSERT INTO `users`(`username`, `password`, `school`, `grade`,`email`, `classes`, `firstname`, `lastname`) VALUES ('$username','$password','$school','$grade','$email','$school','$firstname','$firstname')";
if (preg_match($regex, $password)){
    $result = mysql_query($query);
    if (!$result) {
        $message  = 'Invalid query: ' . mysql_error() . "\n";
        $message  = 'Whole query: ' . $query;
        die($message);
    }
}else{
    $numb = 'true';
    $cap = 'true';
    if (preg_match($regex, $password)){
        $numb = 'false';
    }
    if (preg_match($regex, $password)){
        $cap = 'false';
    }
    echo $cap;
    echo $numb;
}
?>
Taz
  • 3,718
  • 2
  • 37
  • 59
Trevor Judice
  • 137
  • 1
  • 1
  • 10
  • Delimiters are lost. `$regex = '~^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[a-zA-Z\d]{8,}$~';` – Wiktor Stribiżew Feb 03 '16 at 18:07
  • [Your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) – Jay Blanchard Feb 03 '16 at 18:08
  • Please [stop using `mysql_*` functions](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php). [These extensions](http://php.net/manual/en/migration70.removed-exts-sapis.php) have been removed in PHP 7. Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [PDO](http://php.net/manual/en/pdo.prepared-statements.php) and [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) and consider using PDO, [it's really pretty easy](http://jayblanchard.net/demystifying_php_pdo.html). – Jay Blanchard Feb 03 '16 at 18:09
  • Please use PHP's [built-in functions](http://jayblanchard.net/proper_password_hashing_with_PHP.html) to handle password security. If you're using a PHP version less than 5.5 you can use the `password_hash()` [compatibility pack](https://github.com/ircmaxell/password_compat). – Jay Blanchard Feb 03 '16 at 18:09
  • Allow users to use the [passwords / phrases](https://xkcd.com/936/) they desire, [don't limit passwords](http://jayblanchard.net/security_fail_passwords.html) – Jay Blanchard Feb 03 '16 at 18:10
  • One more thing. Passwords should not be allowed to exceed a limit. Your regex insist on more than 8 characters, but it should also impose a higher limit. –  Feb 03 '16 at 18:14
  • Allow users to use the [passwords / phrases](https://xkcd.com/936/) they desire. [Don't limit passwords](http://jayblanchard.net/security_fail_passwords.html) cc:/ @noob – Jay Blanchard Feb 03 '16 at 20:40

1 Answers1

0

I edited and tested your regex. Replace your regex to this:

$regex = "/^((?=.*[a-z])(?=.*[A-Z])(?=.*\d))[a-zA-Z\d]{8,}$/";

And test:

$password_good = "Thecedda123"; // Ok

$password_bad_1 = "hechedda123"; // Upper case missed

$password_bad_2 = "TTTTTTTTTT123"; // Lower case missed

$password_bad_3 = "Thechedda"; // Digit missed

$password_bad_4 = "Th123"; // Less then 8 characters

$password_bad_5 = "1234567890"; // Letters missed

// Result:

echo preg_match($regex, $password_good); // true

echo preg_match($regex, $password_bad_1); // false

echo preg_match($regex, $password_bad_2); // false

echo preg_match($regex, $password_bad_3); // false

echo preg_match($regex, $password_bad_4); // false

echo preg_match($regex, $password_bad_5); // false
Vika Marquez
  • 353
  • 1
  • 3
  • 12