diff --git a/ip_login.module b/ip_login.module
index e94cb84..14d413e 100755
--- a/ip_login.module
+++ b/ip_login.module
@@ -284,19 +284,22 @@ function ip_login_block_view($delta = '') {
  * Callback for hook_form_alter().
  */
 function _ip_login_user_form_validate($form, &$form_state) {
-  //TODO: replace with regexp ideally
-  // validate: replace all non-numeric but legal IP range chars with '|'
-  $value = $form['ip_login_matches']['ip_login_match']['#value'];
-  $ip_login_addresses = strtr($value, ' ,.-*', '|||||');
-
-  foreach (explode('|', $ip_login_addresses) as $quad) {
-    if (!empty($quad) && !is_numeric($quad)) {
-      // bad entry, warn & bail
-      form_set_error(
-        'ip_login_matches',
-        t('Only numbers, spaces, commas, dots, asterisks and hyphens allowed in IP ranges.'));
-    }
-  }
+  // Remove all valid characters and if anything is left over, set an error.
+  if (strlen(preg_replace('~[0-9\x20\x2a\x2c-\x2e]~', '', $form['ip_login_matches']['ip_login_match']['#value']))) {
+    form_set_error(
+      'ip_login_matches',
+      t('Only numbers, spaces, commas, dots, asterisks and hyphens allowed in IP ranges.')
+    );
+  }
+  // Check for invalid ranges along the lines of 123.4.5.6-123.4.5.10.
+  foreach (explode(',', $form['ip_login_matches']['ip_login_match']['#value']) as $quad) {
+    if (substr_count($quad, '.') > 3) {
+      form_set_error(
+        'ip_login_matches',
+        t('Ranges must be in the format 123.4.5.6-10 or 123.4-111.5.6.')
+      );
+    }
+  }
 }
 
 /**
@@ -676,4 +679,4 @@ function _ip_login_set_user_range($uid, $ip_range = NULL) {
     }
   }
   return FALSE;
-}
\ No newline at end of file
+}