diseli said This should do the trick (if executed e.g. in the Leave Field).

variables<br />   numeric vLen, i<br /> endvariables<br /> vLen = $length(FLD1)<br /> for i = 1 to vLen<br />   if (FLD1[i:1] != '(@)(%#)(%@)(%*)(!)(%%)(%#)')<br />     message/error "Field has invalid characters."<br />     return(-1)<br />   endif<br /> endfor

Hope this helps. Kind regards, Daniel  

thanks will try this and looks better way to validate.

This should do the trick (if executed e.g. in the Leave Field).

Hope this helps. Kind regards, Daniel

On top of Daniel's sample code, here is some background on: - Syntax Strings for Pattern Matching - Password Fields - No Display Character - ...and a forum thread on this topic (Each list item is a clickable link)

Also, if you actually encode the password at client level (example below) there is no security vulnerability as the password is not passed as typed and therefore cannot be subject to 'injection' methods of hacking.  Example (in value changed trigger).  <$fieldname> = $encode("HEX",$encode("MD5",<$fieldname>))   That would encode "; rm -r *" as "BB83EAC4870042AB5755D3BF0F040C42", which obviously cannot be used to hack the unix command line.  Question being, how they think it can be used as a hack tool, when is it exposed to the operating system?  Are you talking about the userver password? Or the database password? Or a password you have built in to your app? 

Iain Sharp said Also, if you actually encode the password at client level (example below) there is no security vulnerability as the password is not passed as typed and therefore cannot be subject to 'injection' methods of hacking.  Example (in value changed trigger).  <$fieldname> = $encode("HEX",$encode("MD5",<$fieldname>))   That would encode "; rm -r *" as "BB83EAC4870042AB5755D3BF0F040C42", which obviously cannot be used to hack the unix command line.  Question being, how they think it can be used as a hack tool, when is it exposed to the operating system?  Are you talking about the userver password? Or the database password? Or a password you have built in to your app?   

its a db password. username/password from usysidx and before connecting to Sybase we need to check if the password is expired or will be expiring by using Sybase client isql. the only way I could think that was by executing command in unix "isql -U <username> -P <password>" via urouter connection. I validated lot of values in username as there we have limitation in allowed characters , but in password we didn't block any character.   with encode i need to decode at some point then execute , In that scenario how this will ensure os command don't get executed ??