Such a regular expression is quite simple to make (see perlre for a long explanation). First we start with the RE for one single allowed character. To match a set or a range of characters, we must use the [ and ] chars :

  [A-Z0-9 ,"&-']
[download]

Now we want this RE to match at least four and at maximum 16 characters :

  /^[A-Z0-9 ,"&-']{4,16}$/
[download]

The braces tell Perl to match the previous part of the RE (our set of valid characters) at least 4 times and at maximum 16 times.

There are of course other ways, for example the more clumsy way of doing it like this :

  # Please excuse the long line ;)
  /^[A-Z0-9 ,"&-'][A-Z0-9 ,"&-'][A-Z0-9 ,"&-'][A-Z0-9 ,"&-'][A-Z0-9 ,"
+&-']?[A-Z0-9 ,"&-']? ... repeat total 12 times ... [A-Z0-9 ,"&-']?$/
[download]

Here, the ? tells Perl to optionally match the previous set, in fact, the ? is equivalent to {0,1}.

If you find yourself struggling with REs often, you might want to take a look at Mastering Regular Expressions by Jeffrey Friedel (It is published by O'Reilly, and has a big owl on the cover) - this book covers everything about REs, but I don't know how good it is for beginners.

Update: Here is a direct link to the book.

Update: perlcgi told me that lowercase characters should be allowed as well. D'oh ;) Here we go again :

  # The set for the characters gets changed :
  [A-Za-z0-9 ,"&-']

  # and the RE then looks like this :
  /^[A-Za-z0-9 ,"&-']{4,16}$/

  # and we can modify the RE, so that A-Z also matches
  # a-z with the "i"-modifyer :
  /^[A-Z0-9 ,"&-']{4,16}$/i

  # or equivalent

  /^[a-z0-9 ,"&-']{4,16}$/i
[download]