Use the following pattern:
$strong_password = preg_match('/^(?=.[a-z])(?=.[A-Z])(?=.\d)(?=.[^A-Za-z\d])[\s\S]{6,16}$/', $string);
^ --> start of string
(?=.*[a-z]) --> at least one lowercase letter
(?=.*[A-Z]) --> at least one uppercase letter
(?=.*\d) --> at least one number
(?=.*[^A-Za-z\d]) --> at least one special character
[\s\S]{6,16} --> total length between 6 and 16
$ --> end of string