forgot to mention the security and language compatibility benefit... \w will match non-english characters if locale is set (usually with a language pulldown)

The security benefit is such a login check immunizes you against sql and XSS injection on your login form field by locking in the allowable patterns and size. The approach of the OP was a good one even if he needed a little help with details...

If you use php to hash the user password input instead of mysql's password function, you break sql injection on the password, since you will match passwords on the hashed value, not plain text in the query using mysql's password() function. An injection attempt will just get gobbled. You also avoid sending a plaintext password over your network if the mysqld is on another server.

-Viz