mysql - validate password with preg

i need validate passwords. use: preg_match("/^[a-z0-9_-]*$/i", $pass).

i add length this. mysql table set : userpassword varchar (40) not null,. between 6 , 40 characters. , allow characters not dangerous put in db.

imposing arbitrary complexity rules on passwords user hostile , not improve security substantially. don't it.

here's why i think above statement true:

if want use website "123456" password, it's problem. let me roll it.
you may impose minimum length (e.g. 6 characters), not maximum. if want cite entire john maynard password, let me roll it.
your idea of "secure" password might not else's idea.
people might use password generators not automatically comply rule set. don't annoy them not accepting password no other reason not containing enough/or many "special characters".
you must hash customer's passwords decent hashing algorithm plus random hash salt, different every user. store hash salts , hashes in database, never store clear text passwords.
once hashed, lame password reasonably secure against theft/cracking. implement security against brute-force attacks (time-based lock-outs, ip-based lock-outs, password locking e-mail handshake retrieve locked account).

so password validation process goes this

new user? create user record username , random salt (never change salt value user)
returning user? fetch salt db, re-hash password, compare result hash in db.
never store user's password anywhere physically , use https transmit it.
if not want above, think using oauth site. may not easy either, not have worry password security anymore and users have 1 less password remember.

for sake of argument, regex ask. if you're still desperate it.

preg_match("/^[a-z0-9_-]{6,40}$/i", $pass)

Sohocode