CAKEPHP Model validation 
'password' => array(
            'passlength' => array(
                'rule' => array('between', 6,15),
                'message' => 'Password should consist of 6-15 characters.'
            ),
            'passwordComplexity' => array(
                'rule' => array('passwordComplexity'),
                'message' => 'Must contain mixed-case letters, numbers and special characters @#!$&*_'
            ),
        ), 
public function passwordComplexity($field = array())
    {
        if (isset($this->data[$this->alias]['password'])){
            $pattern = '/^(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*\W)(?!.*\s).{6,20}$/i';
            $subject = $this->data[$this->alias]['password'];
            if (!preg_match($pattern, $subject)){
                return false;
            }
        }
        return true;
    }
VALIDATION regex 
with 41 Step 
/^(?=.*[A-Z])(?=.*[!@#$&*_])(?=.*[0-9])(?=.*[a-z])(?!.*\s).{6,20}$/i
with 38 Step
/^(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*\W)(?!.*\s).{6,20}$/i
For More Help : 
http://www.rubular.com/r/pJRmWeFvKk
https://regex101.com/