$tainted =~ /\A([a-zA-Z0-9]{1-16})\z/i
[download]

Your question as asked is answered, but I wanted to make another note:

$tainted =~ s/\W//g;  # remove all non word characters
if ($tainted =~ /\A([a-zA-Z0-9]{1,16})\z/i)
[download]

Basically, these two lines together say you can have everything in \w match (assuming an ASCII-clean input) except the underscore (and that 'i' at the end of the match statment is useless). Underscores are usually harmless, so it might be better to simply write:

if( $tainted =~ /\A ( \w{1,16} ) \z/x ) {
[download]

Which also has the advantage that if someone inputs 'firstname&lname&&' (which won't pass the length test if the '&' remain), it will spit it back as "failure" instead of doing something with the untainted version (which will be 'firstnamelname', and would pass the length test).

I think you want \Z, not \z. Also, you want {1,16}, not {1-16}.

,welchavw

\Z (upper-case) matches either at the end of the string or just before a newline at the end of the string (just like $ normally does; but $'s behaviour changes with the /m flag, \Z always stays the same).

\z (lower-case) matches only at the end of the string, and is probably what he (assuming for the moment that "punk" implies "male") wants.

In this case, I belive that \z and \Z would be equivalent, as \W chars (including \n's) are stripped just before the matching. Am I right?

• ITYM {1,16}; see perldoc perlre
• Not directly related to the question at hand, but all lowercase package names are usually reserved for pragmatic modules (such as strict or lib).

if ($tainted =~ /\A([a-zA-Z0-9]{1-16})\z/i)

My immediate thought was, if I wanted to check the length of a string, I would use the built-in length() function.

My second thought was, as this line

$tainted =~ s/\W//g;

removes all non-word characters, why bother checking for them all again except one (the underscore) in the next line? Especially as the sub as it stands will return, say, 'NotaNumber' if it's fed with 'Not-a-Number' but will print 'failure' if it gets 'Not_a_Number'. Is this what you really want?

My third thought was that even if your sub prints 'failure', it returns 1 (assuming that the print is successful), which by your definition ('usernames composed of letters or numbers from 1-16 characters') is a valid username :-)

Maybe something like this would be better:

sub untaint_username {
   my $str = shift;
   $str =~ s/[\W_]//g;  # remove all non word characters (incl. unders
+core)
   if ( $str and length $str < 17 ) {   
      return $str;
   }
   else {
      return 'failure!';
   }
}
[download]

Note the exclamation mark in return 'failure!', which is there solely to allow you to deal with the remote possibility that one of your users might decide to call themselves 'failure'...

dave

Update: Just realised that, by your definition, '0' (zero) is also a valid username. Change the if... line to:

Update 2: Better still: