> Are all form fields (with the exception of password fields) validated with a restrictive regex?
Please, whatever you do, do not try to regex validate people's names. A friend couldn't complete an order on a site the other day because it was rejecting his name as "invalid" per its shitty regex.
See also Falsehoods Programmers Believe About Names[1]
[1] http://www.kalzumeus.com/2010/06/17/falsehoods-programmers-b...