The length of search

Hi

Why:

RE re = new RE([:alnum:]{3,8});
re.match("123456789");

.. returns true?
.. and is there any way to get false current situation?

I need to make some security checks for form parameters, and
i need to check that parameter contains 3-8 characters, and regexp
seems quite handy for that.

If thats not possible with regexp, how about ORO?? examples??

SeeU!