Although the client-side validation checks the correct form of the booking reference, it does not actually check it is a valid booking reference.

For a reference to be valid, the server-side should validate the reference to the same format as the client-side, plus the following additional constraints: the three-letter group must be one of ABC, ACD, BCD. Anything else is invalid.

The next character must be a hyphen. Anything else is invalid.

The first digit may only be 5 or 8. The other digits may be any value between 0 and 9 inclusive.

You need to provide checks and only if all are valid, proceed to write the data to the database. If not, provide feedback to the user that the booking reference is invalid.

Add a comment to your validation code explaining the meaning of each part of your booking reference validation expression.

Again, examine the existing code closely, it will guide you.

The easiest way to test regular expressions is using a free online tool search the web for regex tester to discover these.