regexp in validation, security