title: Regexp methodology for password expression
body: <p>I have been using this regexp to verify specific password requirements are met:</p>
  
  <pre><code>$scope.userObj.user_password.match(/^(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.*[!@#\$%\^&amp;\*])(?=.{8,})/)
  </code></pre>
  
  <p>Its been working fine...but I just encountered not one, but two users in the same day who tried to set passwords with period (.) in them.  Never occurred to me that users would do that...funny thing about users is they always find ways to do things you never thought of.  Anyway, I also thought the period was defined as a normal character and not as a special character...so why isn't the above validating as a good password if a period is used?</p>
  
  <p>Second, obviously the above isn't working so to make it work I need to modify the special symbols part to (I think) the following:
  <code>(?=.*[!@#\$%\^&amp;\*\.\,\(\)\-\+\=])</code></p>
  
  <p>In my DB, I encrypt the password with PHP SHA512 and then save that into a standard mysql schar(128) column.  </p>
  
  <blockquote>
    <p>A: Will this suffice for my regexp to properly include periods?  The
    use of periods also makes me wonder if I need to include other
    standard keyboard symbols like , ( ) - + = etc.  (also included in the new regexp).  </p>
    
    <p>B: And then, how far down the rabbit hole do you go - is ~ and ` and
    [, ], {, }, \, | characters that should be considered too?  Is there a
    better way of defining them all without having to list them
    individually?</p>
    
    <p>C: Considering how I store the password and allowing all these extra
    special characters...are there any specific issues or security
    problems I need to be aware of...or things I should avoid?</p>
  </blockquote>