preg_match username validation regex allows > and < despite those characters not being whitelisted

Question

I have this relatively simple regex for usernames

// Enforce that username has to be 3-100 characters, alphanumeric, and first character a letter.
// Possibi         


        

Answer 1

+-_ is your problem. You need to escape the - in a character class or move it to the end or beginning of the class.

For example:

/^[a-z][a-z0-9@.+_-]{2,100}\z/i