如何强制用户设置≥8位的密码？PHP校验功能失效如何解决？

我想要强制用户设置长度大于等于8位的密码，但校验逻辑始终无法生效，先后尝试了count()和strlen()函数，最初写的校验代码如下：

if(count($_POST['newpass']) < 8){
        // ERROR
    }

完整代码补充 #

后端PHP业务代码 #

if(!empty($_POST['update'])){
    
    if( strlen( trim( $_POST['newpass'] ) ) < 8 ){
        $error = error('Password should be at least 8 characters in length.');
    }
    
    $options = array("cost"=>4);
    $hashPassword = password_hash($_POST['newpass'],PASSWORD_BCRYPT,$options);
    
    $getpass = $odb -> prepare("SELECT `password` FROM `users` WHERE `ID` = :id");
    $getpass -> execute(array(":id" => $_SESSION['ID']));
    $row = $getpass -> fetch(); 

    $saved_password = $row['password'];
    
    if (password_verify($_POST['oldpass'], $saved_password)) {
      $SQLUpdate = $odb -> prepare("UPDATE `users` SET `password` = :password WHERE `username` = :username AND `ID` = :id");
      $SQLUpdate -> execute(array(':password' => $hashPassword,':username' => $_SESSION['username'], ':id' => $_SESSION['ID']));
      $error = success('Password has been successfully changed');
    } else {
      $error = error('Current password is incorrect.');
    }

}

前端HTML表单代码 #

<form method="post">
<div class="form-group">
            <label for="recipient-name" class="col-form-label">Current password</label>
            <input class="form-control" style="color:black;" type="password" id="oldpass" name="oldpass" required="">
          </div>
          <div class="form-group">
            <label for="recipient-name" class="col-form-label">New password</label>
            <input class="form-control" style="color:black;" type="password" id="newpass" name="newpass" required="">
          </div>
      </div>
      <div class="form-group">
      <div class="modal-footer">
            <button class="btn btn-primary" name="update" value="change" type="submit">Change</button>
      </div>
      </div>
      </form>

• 初始错误：使用count()做字符串长度校验是完全错误的，count()的作用是统计数组、Countable对象的元素个数，字符串传入count()永远返回1，所以只要不是传递数组类型的密码参数，永远不会触发长度不足的校验
• 核心错误：更换为strlen()后，仅在校验不通过时设置了$error错误提示，没有终止后续的密码更新逻辑，所以就算密码长度不符合要求，只要旧密码校验通过，还是会直接修改密码，导致长度校验完全不生效

修复后的PHP代码示例 #

if(!empty($_POST['update'])){
    $error = '';
    // 校验密码长度
    if( strlen( trim( $_POST['newpass'] ) ) < 8 ){
        $error = error('密码长度不能少于8位');
    }
    
    // 只有没有错误的时候才执行后续密码更新逻辑
    if(empty($error)){
        $options = array("cost"=>4);
        $hashPassword = password_hash($_POST['newpass'],PASSWORD_BCRYPT,$options);
        
        $getpass = $odb -> prepare("SELECT `password` FROM `users` WHERE `ID` = :id");
        $getpass -> execute(array(":id" => $_SESSION['ID']));
        $row = $getpass -> fetch(); 

        $saved_password = $row['password'];
        
        if (password_verify($_POST['oldpass'], $saved_password)) {
          $SQLUpdate = $odb -> prepare("UPDATE `users` SET `password` = :password WHERE `username` = :username AND `ID` = :id");
          $SQLUpdate -> execute(array(':password' => $hashPassword,':username' => $_SESSION['username'], ':id' => $_SESSION['ID']));
          $error = success('密码修改成功');
        } else {
          $error = error('当前密码输入错误');
        }
    }
}

内容的提问来源于stack exchange，提问作者juliaroje86