In other words, I would only have to guess any userid or any password to pass your test!! Not good.

Your code doesn't improve on that. ;)

— Arien

Edit: Just to clarify, guessing any character anywhere will do. And let's not even talk about passing something like a dot in when not using quotemeta.