REGEX SAFETY GUIDE · 7 MIN READ

How to escape text before putting it in a regular expression

A dot, bracket or dollar sign has special meaning in a regular expression. When the goal is to match those characters literally, user or file text must be escaped before it becomes part of a pattern.

Know the metacharacters

Characters such as . * + ? ^ $ { } ( ) | [ ] and backslash control pattern behaviour. Prefixing them with a backslash makes a JavaScript-style regex match the character itself.

Escape the pattern fragment, not everything

Regex delimiters and flags are separate from the text being inserted. Replacement strings follow different rules, especially around dollar signs and capture groups.

Test hostile and empty inputs

Try punctuation-only strings, backslashes, line breaks and an empty value. Use the Regex Tester to confirm the final composed pattern and avoid catastrophic broad expressions.

Worked example

Literal text 'price $10.00 (USD)' becomes 'price \$10\.00 \(USD\)' before insertion into a pattern.

Limitations to review

• Regex dialects differ between languages.
• Escaping does not make a slow surrounding pattern safe.
• Replacement text requires separate handling.