Use regular expressions to verify password strength

This time I will bring you the use of regular expressions to verify password strength, and what are the precautions for using regular expressions to verify password strength. The following is a practical case, let's take a look.

Preface

, password regularization will be used test. To write a correct regular expression, you must first define the expression rules.

Option 1 (Simple) Assume that password verification is defined as follows:

Shortest 6 digits, up to 16 digits {6,16}
can include lowercase letters [a-z] and uppercase letters [A-Z]
Can contain numbers [0-9]
Can contain underscores [_] and minus signs [-]
According to the above rules, it is easy The regular literal definition is given as follows:

var pattern = /^[\w_-]{6,16}$/;

Scheme 1 AnalysisLiteral/ /

regular expression A literal is defined as a character contained between a pair of slashes (/), for example:

var pattern = /s$/;

The above literal matches all strings ending with the letter "s".

Put characters in square brackets to form a character class. A character class can match any character it contains. Therefore, the regular expression /[abc]/ matches any of the letters "a", "b", or "c".

Character classes may use hyphens to represent

. To match Latin lowercase letters use /[a-z]/ .

Character class \w matches any word composed of ASCII characters, equivalent to [a-zA-Z0-9].

[\w_-] means matching any Latin uppercase and lowercase letters, numbers plus underscores and minus signs.

Use { } in regular expressions to represent the number of times an element repeats.

{n,m} Match the previous item at least n times, but not more than m times
{n,} Match the previous item n times or more
{n} matches the previous item n times

• 
  

[\w_-]{6,16} means matching any Latin uppercase and lowercase letters, numbers plus underscores and minus signs appearing at least 6 times and at most 16 times.

^ Matches the beginning of the string, in multi-line retrieval, matches the beginning of a line

/^\w/ and match strings starting with uppercase and lowercase letters or numbers.

Option 1 testThe test results are given as follows:

var pattern = /^[\w_-]{6,16}$/;
pattern.test('123456') = true;
pattern.test('-ifat33') = true;
pattern.test('42du') = false;
pattern.test('du42du42du42du421') = false;
pattern.test('42du42@') = false;

View source code

According to the test It can be seen from the results that Solution 1 only briefly limits the password and cannot guarantee the strength of the password and the security of the account.

Option 2 (Security) Assume that password verification is defined as follows:

Shortest 6 digits, up to 16 digits {6,16}
must contain 1 number
must contain 2 lowercase letters
must contain 2 uppercase letters
must contain 1
• special character

According to the above rules, it is easy to give the definition of regular literals as follows:

var pattern = /^.*(?=.{6,16})(?=.*\d)(?=.*[A-Z]{2,})(?=.*[a-z]{2,})(?=.*[!@#$%^&*?\(\)]).*$/;

Analysis of scenario 2

Character class. Represents any character except newlines and other Unicode line terminators.

在符号“(?=” 和 “)” 之间加入一个表达式，它就是一个先行断言，用以说明圆括号内的表达式必须正确匹配。比如： /Java(?=\:)/ 只能匹配Java且后面有冒号的。

var pattern = /^.*(?=.{6,16})(?=.*\d)(?=.*[A-Z]{2,})(?=.*[a-z]{2,})(?=.*[!@#$%^&*?\(\)]).*$/;
pattern.test('du42DU!') = true;
pattern.test('duDUd!') = false;
pattern.test('42dud!') = false;
pattern.test('42DUD!') = false;
pattern.test('42duDU') = false;
pattern.test('42duU(') = false;
pattern.test('42dUU!') = false;

The above is the detailed content of Use regular expressions to verify password strength. For more information, please follow other related articles on the PHP Chinese website!