my bash at all 5 - actually I'm really seeking comment/abuse from others - I'd really like to know what best practice is when it comes to RE construction.

and I changed #5 to _CANNOT_ be userid or reverse of userid, otherwise ...

#!/usr/bin/perl -w

use strict;

my $password = "10diresu";

my $userid = "userid00";

print "huzzah\n" if _check_password($password, $userid);

sub _check_password {
  my ($password, $userid) = @_;

  return undef if ! $password or ! $userid;
  
  my $rev_id = reverse $userid;

  my $rule1   = qr(^[\w\d]{8,12}$);
  my $rule2   = qr((?:[a-zA-Z]\d)|(?:\d[a-zA-Z]));
  my $rule3   = qr(_);
  my $rule4   = qr((.)\1{2}); # thanx Enlil
  my $rule5 = qr($userid|$rev_id);

  if ($password =~ $rule1   and
      $password =~ $rule2   and
      $password !~ $rule3   and
      $password !~ $rule4   and
      $password !~ $rule5) {
    return 1;
  }
  return 0;
}
[download]

if I was doing this in anger, I'd wrap this in a module and write a .t file with ad infinitum test cases - consider this a prototype