You're missing the anchors in the regular expression, so the regex can comfortably match 3 characters in the character class anywhere in the string. This is not what you want. You want to check if your regex matches against the entire string. For that, you need to include the anchors (^
and $
).
if(!preg_match('/^[A-Za-z0-9 _]{3,12}$/', $content)
^ ^
^
asserts the position at the beginning of the string and $
asserts position at the end of the string. It's important to note that these meta characters do not actually consume characters. They're zero-width assertions.
Further reading: