Add an 'alpha_numeric_punct' rule to FormatRules

[dafriend]

A validation rule that allows alphanumerics, space and a limited set of punctuation characters.
The proposed set of punctuation chars are:
~ (tilde),
! (exclamation),
# (number),
$ (dollar),
% (percent),
& (ampersand),
* (asterisk),
- (dash),
_ (underscore),
+ (plus),
= (equals),
| (vertical bar),
: (colon),
. (period).

This rule would broaden the set of characters available for passwords.

Here's the proposed function definition

/**
 * Alphanumeric, spaces, and a limited set of punctuation characters.
 * Accepted punctuation characters are: ~ tilde, ! exclamation,
 * # number, $ dollar, % percent, & ampersand, * asterisk, - dash,
 * _ underscore, + plus, = equals, | vertical bar, : colon, . period
 * ~ ! # $ % & * - _ + = | : .
 *
 * @param string $str
 *
 * @return boolean
 */
public function alpha_numeric_punct($str)
{
        return (bool) preg_match('/^[A-Z0-9 ~!#$%\&\*\-_+=|:.]+$/i', $str);
}

I have a PR ready if this is, or could be made, agreeable.

[MGatner]

I like it. The chosen punctuation seems slightly arbitrary but looks like it is well documented and won't affect existing rules. Send the PR on over (with tests hopefully?) and unless Lonnie objects I think it would be a good addition.

[dafriend]

The chosen set leaves out a few chars that are potentially harmful (I think) in an exploit kind of way. I am truly not sure if that's needed or not, but that''s why $ [ ] { } < > ` \ ; / " ' were left out.

[MGatner]

Of course! I didn’t mean my comment to sound disparaging. There’s some lack of standards here such that any implementation will have to make some of these choices. “@“ was the one that I noticed but those you just mentioned could also have escaping/parsing implications

[dafriend]

No worries. You did not sound disparaging.

In the case of '@', it was excluded to help prevent attempts at using email addresses like constructs. Maybe that's not appropriate as it might limit the usefulness of the rule. Or, maybe not. Discussion is good for hashing out these kinds of things. Now I'm ambivalent about '@'.