Password validation with Regex

Question

I am trying to get a different error for each type: missing uppercase, missing lower case, missing number, or space. The length seems to be the only thing working. I am guessing because it is at the start of the code. I have tried different variations and can't seem to get it working.

    <?php
    $Passwords = array(
"F!ve5",
"This !s12",
"w!zard12",
"W!ZARD12",
"W!zardJK",
"Wizard12",
"!Qazxsw2",
"@Wsxzaq1",
"@Wsxcde3",
"#Edcxsw2");

foreach ($Passwords as $StongPass) {
echo "<p>The Password &ldquo;" . $StongPass .
    "&rdquo; </p>";
if (strlen($StongPass)<8) 
    echo "Password is to short!";

elseif (strlen($StongPass)>16)
    echo "Password is to long!";

elseif (preg_match('/P[A-Z]/', $StongPass)) 
    echo "Password does not contain an upper case letter!";

elseif (preg_match('/P[a-z]/', $StongPass)) 
    echo "Password does not contain a lower case letter!";

elseif (preg_match('/P[!@#$%^&*()\-_=+{};:,<.>]/', $StongPass)) 
    echo "Password does not contain a special letter!";

elseif (preg_match('/P[0-9]/', $StongPass)) 
    echo "Password does not contain a number!";

elseif (preg_match('/P[""]/', $StongPass)) 
    echo "Password cannot contain any spaces!";

else 
    echo "Password is strong!";

    }
    ?>

The results look like this "The Password “F!ve5” Password is to short! The Password “This !s12” Password is strong! The Password “w!zard12” Password is strong! The Password “W!ZARD12” Password is strong!"

Answer 1

There's a lot of PHP code here that's redundant since the whole validation can be done in a single regular expression by using a series of look-ahead groups.

Using this pattern

/^(?=.*[A-Z])(?=.*[a-z])(?=.*[0-9])(?=.*[,;:])(?=.{8,16})(?!.*[\s])/

each group (between the parentheses) matches an element of the required validation somewhere in the following string and then resets the pointer for the next group. The string thus has to match each group in the pattern to pass.

Broken down to its components we get

^            Make sure we start at the beginning of the string.
(?=.*[A-Z])  Match A-Z in the string
(?=.*[a-z])  Match a-z (separate, since we want at least one of each)
(?=.*[0-9])  Match 0-9
(?=.*[,;:])  Match comma, semicolon or colon. Add additional special characters as required
(?=.{8,16})  Match length between 8 and 16 characters
(?!.*[\s])   Match if whitespace *does not* appear.

In PHP this would become

$pattern = '/^(?=.*[A-Z])(?=.*[a-z])(?=.*[0-9])(?=.*[,;:])(?=.{8,16})(?!.*[\s])/'
$str = "Ab0:padding";
if (preg_match($pattern, $str)) {    //true
  // do stuff
} else {
  // Do other stuff
}

Alternatively:

$pattern = '/^(?=.*[A-Z])(?=.*[a-z])(?=.*[0-9])(?=.*[,;:])(?=.{8,16})(?!.*[\s])/'
$str = "Ab0: padding";
if (preg_match($pattern, $str)) {    // false
  // do stuff
} else {
  // Do other stuff
}

There's an example to play with here

Thanks to Alan Moore for this answer which forms the basis of the above.

Answer 2

A capital P has no special meaning in a regex. This was kind of a mess. Notice the use of !preg_match() in some cases. I completely rewrote the check for symbols because many of them have special meaning and it is a bit easier to use an ASCII chart to group them.

if (strlen($StongPass)<8) 
    echo "Password is to short!";

elseif (strlen($StongPass)>16)
    echo "Password is to long!";

elseif (!preg_match('/[A-Z]/', $StongPass)) 
    echo "Password does not contain an upper case letter!";

elseif (!preg_match('/[a-z]/', $StongPass)) 
    echo "Password does not contain a lower case letter!";

elseif (!preg_match('/[!-\/:-@[-`{-~]/', $StongPass)) 
    echo "Password does not contain a special letter!";

elseif (!preg_match('/\d/', $StongPass)) 
    echo "Password does not contain a number!";

elseif (preg_match('/\s/', $StongPass)) 
    echo "Password cannot contain any spaces!";

else 
    echo "Password is strong!";