How to construct regex for password in SQL? - sql

Question

I'm creating a new stored procedure for user register on my web application. I need to validate user password to be in a format of:
It must contain at least one number or letter
It must contain at least one special character
I need to manage to write this using regex.
This is for a new Database that i have created in SQL server 2017. My database is okay working fine and also my email validation is fine and working.
IF (#password NOT LIKE '%[a-zA-Z0-9]%' OR #password NOT LIKE '%~!##$%^&*()_+-={}[]:"|\;,./<>?''%' OR LEN(#password) < 8)
BEGIN
SET #message = 'Invalid credentials'
RETURN;
END
ELSE
SET #message = 'Success'
RETURN;
END
this is my code so far ad honestly i tried a lot of combinations and still nothing.
I expect the output for a password like !Password123 to be Success but instead i'm still getting "Invalid credentials" and for password like Password123! i am still getting "Invalid credentials"

Answer 1

While it would be ideal to have access to a full regex engine, which would let you write a more robust password check, you actually can handle your requirements using SQL Server's enhanced LIKE operator. The problem I see with your current code is that you are not escaping the square brackets in the second LIKE expression which checks for the presence of a special character. You may tell SQL Server how you plan to escape square brackets using ESCAPE as follows:
DECLARE #password VARCHAR(500);
SET #password = '!Password123';
SELECT 1
WHERE
#password NOT LIKE '%[a-zA-Z0-9]%' OR
#password NOT LIKE '%[~!##$%^&*()_+-={}\[\]:"|\;,./<>?'']%' ESCAPE '\' OR
LEN(#password) < 8;
The above query returns nothing, indicating that !Password123 is a valid password.