I'm going mental trying to figure out why this doesn't work:

function hasOnlyWhitelistedCharacters(string)
{
    var whitelist = RegExp("\\w");
    console.log(whitelist.test(string));
    return whitelist.test(string);
}

When I run this string: "wwww?????**<><><"

Into this function, it returns true. Shouldn't it return false? In fact, it seems like no matter what I do it returns true.

These also don't work:

var whitelist = RegExp(\w);
var whitelist = /\w/;

I'm going mental trying to figure out why this doesn't work:

function hasOnlyWhitelistedCharacters(string)
{
    var whitelist = RegExp("\\w");
    console.log(whitelist.test(string));
    return whitelist.test(string);
}

When I run this string: "wwww?????**<><><"

Into this function, it returns true. Shouldn't it return false? In fact, it seems like no matter what I do it returns true.

These also don't work:

var whitelist = RegExp(\w);
var whitelist = /\w/;

• javascript
• regex
• security

6 Answers 6

/\w/ matches a single identifier character ([0-9a-zA-Z_]) anywhere in the string. To test against the entire string, use anchors ("^" and "$") and repetition ("+" or "*", depending on whether you want to allow the empty string). Try /^\w*$/ or /^\w+$/, or test for the strings you don't want with /\W/.

function hasOnlyWhitelistedCharacters(string)
{
    var whitelist = /^\w*$/;
    console.log(whitelist.test(string));
    return whitelist.test(string);
}
function hasNoBlacklistedCharacters(string)
{
    var blacklist = /\W/;
    console.log(blacklist.test(string));
    return ! blacklist.test(string);
}

For a more plex blacklisted character class, you can use a plemented class:

function hasOnlyWhitelistedCharacters(string)
{
    // match all characters, which must be in the set
    var whitelist = /^[\w\s\u00C0-\uDFFF\uF900-\uFFFF]*$/;
    console.log(whitelist.test(string));
    return whitelist.test(string);
}

function hasNoBlacklistedCharacters(string)
{
    // match one character not in the set
    var blacklist = /[^\w\s\u00C0-\uDFFF\uF900-\uFFFF]/;
    console.log(blacklist.test(string));
    return ! blacklist.test(string);
}

Be careful about character encoding when using regular expressions. Actually, be careful about character encoding in any context. Assumptions about encodings could lead to security holes.

Try this:

var whitelist=/^\w*$/;

The ^ forces it to try matching at the beginning of the string. The $ forces it to match the end. The * after \w makes it match more than one instance of \w.

If you're trying to check whether the target string only contains whitelisted characters, you need to specify you want nothing but them. Add a start and end token and repetition to make it work.

^\w+$

to match at least one white-listed character in a set of white-listed characters , try this: ^\w+$

to match at least zero white-listed characters in a set of white-listed characters , try this: ^\w*$

- The carat (^) means that the pattern has to be at the beginning of the string, and the dollar sign ($) means that the pattern has to be at the end of the string. By wrapping what you would like to search for in ^$, any non-specified "junk" will force the regex to return false.

To answer your question though:

\\w SHOULD return false because you are un-escaping the backslash and turning it into a normal character. You're actually searching for literally "backslash double-u"

\w will return true because you are searching for any white-listed character

A quick google search gave me some websites where you can test your regex (if you would like) and they will help provide some feedback:

http://www.myregextester./index.php

I'd also like to suggest using a cheat sheet when making regex if you don't have everything memorized

http://www.regular-expressions.info/reference.html

It return true because wwww?????**<><>< string have whitelisted characters. You must add beginning and end of the string in this regexp

It returns true, because first character is character and your regexp tests only that first character is character. Try \w+$ if i understood what you want