Which are the accepted characters used in username and password?

Question

Hello,
I would like to build a program using regex in order to accept the desirable characters username and password must have.
In my pogram i have the followings:
Username: 4 - 7 characters, I accept only letters,digits and _
Password: 6 - 8 characters, everything that is on keyboard such as @,#,$ , > , ) ? , ' , "
What shall i do?Are the previous right?
May you please tell me your opinion as far as accepted characters in username and password are concerned?
Thanks,in advance!

Answer 1

sabre150 wrote:
jverd wrote:
sabre150 wrote:
and why put an upper limit on the number of characters in the password and why exclude certain characters in the password.
Every restriction you place on a password reduces the available entropy and therefore makes it easier to crack.However, certain resrictions--such as requiring at least one non-letter, not allowing dictionary words, not allowing it to contain the username, etc., while slightly reducing the average time for a brute force attack, can make other very quick attacks--like a dictionary attack--untenable. So there are some restrictions that are a good idea.I will concede this but it I am not keen on protecting a user from his own stupidity. Since this namby-pamby approach is the industry norm I have to go along with it but I hate it.In some cases you may be protecting your own assets from the user's stupidity, depending on what his account gives him access to.