$re = '/^ZZ=.*\r?\n.*\r?\n(?!XXX\b).*(?:\r?\n.+)*(?:\r?\n){2}.*\r?\n.*\s*/m';
$str = 'ZZ=101
OO
XXX
111111111111
222222222222
00000000000
AAAAAAAAAAAA
valid file example
ZZ=101
OO
XXX
111111111111
222222222222
00000000000
AAAAAAAAAAAA
Not valid file
ZZ=101
OO
XSS (should be rejected except XXX)
111111111111
222222222222
00000000000
AAAAAAAAAAAA
Not valid file
HH=101 (should be rejected except ZZ=)
OO
XXX (should be rejected except XXX)
111111111111
222222222222
00000000000
AAAAAAAAAAAA';
preg_match($re, $str, $matches, PREG_OFFSET_CAPTURE, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php