diff --git a/src/admin/sys_admin_user_add.php b/src/admin/sys_admin_user_add.php
index a7087181..4be80f23 100644
--- a/src/admin/sys_admin_user_add.php
+++ b/src/admin/sys_admin_user_add.php
@@ -14,8 +14,12 @@ require_once(DEDEINC."/typelink/typelink.class.php");
 if (empty($dopost)) $dopost = '';
 if ($dopost == 'add') {
     CheckCSRF();
-    if (preg_match("#[^0-9a-zA-Z_@!\.-]#", $pwd) || preg_match("#[^0-9a-zA-Z_@!\.-]#", $userid)) {
-        ShowMsg('密码或账号不合法，请使用数字0-9小写a-z大写A-Z符号_@!.-', '-1');
+    if (preg_match("#[^0-9a-zA-Z_@!\.-]#", $userid)) {
+        ShowMsg('账号不合法，请使用数字0-9小写a-z大写A-Z符号_@!.-', '-1');
+        exit();
+    }
+    if ($pwd != '' && preg_match("#[^0-9a-zA-Z_@!\.-]#", $pwd)) {
+        ShowMsg('密码不合法，请使用数字0-9小写a-z大写A-Z符号_@!.-', '-1');
         exit();
     }
     $safecodeok = substr(md5($cfg_cookie_encode.$randcode), 0, 24);
diff --git a/src/admin/sys_admin_user_edit.php b/src/admin/sys_admin_user_edit.php
index d3540cbf..bb4eca2b 100644
--- a/src/admin/sys_admin_user_edit.php
+++ b/src/admin/sys_admin_user_edit.php
@@ -16,14 +16,14 @@ $id = preg_replace("#[^0-9]#", '', $id);
 if ($dopost == 'saveedit') {
     CheckCSRF();
     $pwd = trim($pwd);
-    if ($pwd != '' && preg_match("#[^0-9a-zA-Z_@!\.-]#", $pwd)) {
-        ShowMsg('密码不合法，请使用数字0-9小写a-z大写A-Z符号_@!.-', '-1');
-        exit();
-    }
     if (preg_match("#[^0-9a-zA-Z_@!\.-]#", $userid)) {
         ShowMsg('账号不合法，请使用数字0-9小写a-z大写A-Z符号_@!.-', '-1');
         exit();
     }
+    if ($pwd != '' && preg_match("#[^0-9a-zA-Z_@!\.-]#", $pwd)) {
+        ShowMsg('密码不合法，请使用数字0-9小写a-z大写A-Z符号_@!.-', '-1');
+        exit();
+    }
     $safecodeok = substr(md5($cfg_cookie_encode.$randcode), 0, 24);
     if ($safecodeok != $safecode) {
         ShowMsg("请填写正确的验证安全码", "sys_admin_user_edit.php?id={$id}&dopost=edit");
diff --git a/src/install/install.html b/src/install/install.html
index ab7f51ab..a3c38c4b 100644
--- a/src/install/install.html
+++ b/src/install/install.html
@@ -84,12 +84,12 @@
 						</div>
 						<div class="form-group">
 							<label for="adminuser" class="form-label">管理员账号</label>
-							<input type="text" name="adminuser" id="adminuser" class="form-control" placeholder="admin">
+							<input type="text" name="adminuser" id="adminuser" class="form-control" placeholder="admin" onkeyup="this.value=this.value.replace(/[^0-9a-zA-Z_@!\.-]/g,'');">
 							<div class="form-text">请使用数字0-9小写a-z大写A-Z符号_@!.-</div>
 						</div>
 						<div class="form-group">
 							<label for="adminpwd" class="form-label">管理员密码</label>
-							<input type="text" name="adminpwd" id="adminpwd" class="form-control" placeholder="admin">
+							<input type="text" name="adminpwd" id="adminpwd" class="form-control" placeholder="admin" onkeyup="this.value=this.value.replace(/[^0-9a-zA-Z_@!\.-]/g,'');">
 							<div class="form-text">请使用数字0-9小写a-z大写A-Z符号_@!.-</div>
 						</div>
 						<div class="text-right"><button type="submit" class="btn btn-success">安装</button></div>
diff --git a/src/user/reg_new.php b/src/user/reg_new.php
index 7e82f176..056daec5 100755
--- a/src/user/reg_new.php
+++ b/src/user/reg_new.php
@@ -51,8 +51,12 @@ if ($step == 1) {
             ShowMsg('账号不合法，请使用数字0-9小写a-z大写A-Z符号_@!.-', '-1');
             exit();
         }
+        if ($userpwd != '' && preg_match("#[^0-9a-zA-Z_@!\.-]#", $userpwd)) {
+            ShowMsg('密码不合法，请使用数字0-9小写a-z大写A-Z符号_@!.-', '-1');
+            exit();
+        }
         if ($pwdc != $pwd) {
-            ShowMsg('您两次输入的密码不一致', '-1');
+            ShowMsg('您两次输入的密码不一致，请重新输入', '-1');
             exit();
         }
         $uname = HtmlReplace($uname, 1);