You need to anchor your pattern and use lookahead to validate those cases.
if(preg_match('/^(?=.*[A-Z])(?=.*[a-z])(?=.*[0-9])[a-zA-Z0-9@:.]+$/', $username)) { ... }
(?= ... )
is a zero-width assertion which does not consume any characters on the string.
Therefore, It only matches a position in the string. The point of zero-width is the validation to see if a regular expression can or cannot be matched looking ahead from the current position, without adding to the overall match.
2
solved Regex for Username and Password verification