php filiter out special characters for userids and passwords -

i prevent new users including apostophes, quotations , other special characters in userids , passwords i've found these can create unexpected problems down road. rather anticipate every 1 of these problems, i'd rather prohibit users including characters when signing in first place.

there lot of questions , stuff on web in how escape them put them in database not issue. want throw error msg says enter different.

i have tried:

$username = $_post['username']; if (preg_match ("/[&<>%\*\,\.\'\"]/i", $uid)) { $strerror="your userid may not contain special character.  please try again."; } 

but throwing error no ending delimiter ''' found.

would appreciate suggestions.

thanks.

i think going wrong way. instead of blacklisting special chars try whitelisting letters , digits e.g.

$username = $_post['username']; if (!preg_match('/^[\w\d]$/', $uid)) {     $strerror="your userid may not contain special character.  please try again."; } 

to include asterisk , semicolon:

$username = $_post['username']; if (!preg_match('/^[\w\d\*;]$/', $uid)) {     $strerror="your userid may not contain special character.  please try again."; }