Apart from your question, it's much easier and better (in terms of security) to check if the user has entered valid characters than to check for invalid characters. Your regex matches the string %()#^ which is not what you want. Valid characters in this case are whitespace, digits and colons: