[DoggettCK]

Well, they wanted 4 of 4, actually, and yes, I had to do custom validation. Everything except the upper-case character worked in JS, so everything "just worked" if I took that part out, but that wasn't an option.

[pc86]

My bad, I thought you were referencing the OWASP site specifically.