I think this should look like that:
if(!preg_match('/^(?=.*d)(?=.*[A-Za-z])[0-9A-Za-z!@#$%]{8,12}$/', $password)) {
echo 'the password does not meet the requirements!';
}
Between start -> ^
And end -> $
of the string there has to be at least one number -> (?=.*d)
and at least one letter -> (?=.*[A-Za-z])
and it has to be a number, a letter or one of the following: !@#$% -> [0-9A-Za-z!@#$%]
and there have to be 8-12 characters -> {8,12}
As user557846 commented to your question, I would also suggest you to allow more characters, I usually (if i use a maximum) take at least 50 :)
btw, you might want to take a look at this regex tutorial
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…