$re = '/(?s-i)(<User>\s*USER_NAME\s*<\/User>.*?<Password>\s*)(\S+)(\s*<\/Password>)/m';
$str = ' <Connection type="Teradata" autoCommit="True">
<Path>Teradata\\BEDW - USER_NAME1</Path>
<AutoConnect>False</AutoConnect>
<DefaultOnStartup>False</DefaultOnStartup>
<Database>
</Database>
<Host>teraprd2.ca.host.com</Host>
<User>USER_NAME1</User>
<Category>F00000FF:Production</Category>
<Password>ENCRYPTED_PWD1</Password>
<WinAuth>False</WinAuth>
<LastConnectionDate>2019-09-11T16:32:09.1945969</LastConnectionDate>
<SessionMode>Teradata</SessionMode>
<SessionCharacterSet>UTF16</SessionCharacterSet>
<PortNumber>1025</PortNumber>
<DataEncryption>False</DataEncryption>
<ResponseBufferSize>1040000</ResponseBufferSize>
</Connection>
</Connections>
<Groups />
</Group>
<Group name="EFBI - USER_NAME" description="">
<Path>Teradata</Path>
<Connections>
<Connection type="Teradata" autoCommit="True">
<Name>USER_NAME @TERADEVL (EFBI_DEV1_USAGE_METRICS_B)</Name>
<Path>Teradata\\EFBI - USER_NAME</Path>
<AutoConnect>False</AutoConnect>
<DefaultOnStartup>False</DefaultOnStartup>
<Database>EFBI_DEV1_USAGE_METRICS_B</Database>
<Host>teradevl.ca.host.com</Host>
<User>USER_NAME</User>
<Category>BCCF87FF:Development</Category>
<Password>ENCRYPTED_PWD2</Password>
<WinAuth>False</WinAuth>
<LastConnectionDate>2019-04-30T15:41:31.3601044</LastConnectionDate>
<SessionMode>Teradata</SessionMode>
<SessionCharacterSet>UTF16</SessionCharacterSet>
<PortNumber>1025</PortNumber>
<DataEncryption>False</DataEncryption>
<DefaultDatabase>EFBI_DEV1_USAGE_METRICS_B</DefaultDatabase>
<ResponseBufferSize>1040000</ResponseBufferSize>
</Connection>
';
$subst = "$1(NEW_ENCRYPTED_PWD)$3";
$result = preg_replace($re, $subst, $str);
echo "The result of the substitution is ".$result;
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php