preg_match username validation regex allows > and < despite those characters not being whitelisted

Question

I have this relatively simple regex for usernames

// Enforce that username has to be 3-100 characters, alphanumeric, and first character a letter.
// Possibi         


        

Answer 1

I think it's because of this: [+-_]

You are including all chars between '+' and '_', try changing the order to [+_-] (putting the dash at the end) or escape the dash.

Answer 2

+-_ is your problem. You need to escape the - in a character class or move it to the end or beginning of the class.

For example:

/^[a-z][a-z0-9@.+_-]{2,100}\z/i