PHP -> REGEX | password validation not working - php

Question

I use this (almost) complex password verification:
function is_password($password) {
return preg_match("^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{6,20}$", $password);
}
So it must contain:
one digit from 0-9,
one lowercase character,
one uppercase character,
at least 6 characters
at most 20 characters
This does not seem to work. Whenever I type certain characters like e, t, o, j, c and b; the function returns true if allowed length is correct. So uppercase and digit is not being validated..
What am I doing wrong?

Answer 1

You forgot to use delimiters. Use this code instead:
return preg_match("/^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{6,20}$/", $password);
Or you may split each condition and use this code:
return mb_strlen($password)>=6 && mb_strlen($password)<=20
&& preg_match("/[a-z]+/", $password) && preg_match("/[A-Z]+/", $password)
&& preg_match("/[0-9]+/", $password);

Answer 2

I would break this apart into multiple checks. This will allow you to intelligently give feedback to the user (or to a log) as to why the password selection failed.
<?php
function is_password($password){
if (strlen($password) < 6) {
// too short
return false;
}
if (strlen($password) > 20) {
// too long
return false;
}
if (!preg_match("/[A-Z]/", $password) {
// no upper
return false;
}
if (!preg_match("/[a-z]/", $password) {
// no lower
return false;
}
if (!preg_match("/[0-9]/", $password) {
// no digit
return false;
}
return true;
}
?>