Why is this PHP not being checked?
As written, this regex will match zero or more of the listed characters at the beginning of the line, which means it will always succeed, no matter what is in the input string. If you want to restrict the input to only those characters, you need to bind it at both ends:
'/^[0-9a-zA-Z_@ !-]*$/'
But keep in mind that it will still match an empty string; if you want to prevent this, you should change *
to +
.
Notice how I removed two from the hyphen and added one to the end of the character class. Since hyphens have a special meaning in character classes, you must make it as clear as possible if you want you to match literally. You do this either with a backslash or by placing it in the first or last position.
The "extra" hyphens in your regex were actually treated as literal hyphens because they couldn't form the ranges where they were — in each case, the previous character was already part of the range. However, don't rely on this behavior; not all regex flavors are as simple as PHP. And of course this looks like a bug to anyone reading your code.
source to share