On 5/29/07, Ken Snyder <ksnyder at coremr.com> wrote: > If you want to allow a dash character, you have to escape it ("\-") or > put the dash right before the bracket. Right now you have > space-dash-period (" -.") which will allow any character with an ascii > code between space (32) and period (46) among which asterisk (42) > happens to fall. Try this: > > preg_match("/^[a-zA-Z0-9 \-.(),]+$/", 'abc**def'); Also, aren't periods normally the "any" character? Wouldn't the period have to be escaped as well? or not in ranges?