I want to ignore square brackets when using javascript regex [duplicate]

Question

I am using javascript regex to do some data validation and specify the characters that i want to accept (I want to accept any alphanumeric characters, spaces and the following !&,'\- and maybe a few more that I'll add later if needed). My code is:

var value = userInput;
var pattern = /[^A-z0-9 "!&,'\-]/;
if(patt.test(value) == true) then do something

It works fine and excludes the letters that I don't want the user to enter except the square bracket and the caret symbols. From all the javascript regex tutorials that i have read they are special characters - the brackets meaning any character between them and the caret in this instance meaning any character not in between the square brackets. I have searched here and on google for an explanation as to why these characters are also accepted but can't find an explanation.

So can anyone help, why does my input accept the square brackets and the caret?

Answer 1

The reason is that you are using A-z rather than A-Za-z. The ascii range between Z (0x5a) and a (0x61) includes the square brackets, the caret, backquote, and underscore.

Answer 2

Your regex is not in line with what you said:

I want to accept any alphanumeric characters, spaces and the following !&,'\- and maybe a few more that I'll add later if needed

If you want to accept only those characters, you need to remove the caret:

var pattern = /^[A-Za-z0-9 "!&,'\\-]+$/;

Notes:

1. A-z also includesthe characters:

   [\]^_`

   .

   Use A-Za-z or use the i modifier to match only alphabets:

    var pattern = /^[a-z0-9 "!&,'\\-]+$/i;
   

2. \- is only the character -, because the backslash will act as special character for escaping. Use \\ to allow a backslash.

3. ^ and $ are anchors, used to match the beginning and end of the string. This ensures that the whole string is matched against the regex.

4. + is used after the character class to match more than one character.

---

If you mean that you want to match characters other than the ones you accept and are using this to prevent the user from entering 'forbidden' characters, then the first note above describes your issue. Use A-Za-z instead of A-z (the second note is also relevant).