What is Regex?

A regex is a pattern built from literal characters and metacharacters: symbols like ^, $, *, and [a-z] that stand for positions, repetition, or sets of characters. A regex engine compares that pattern against your text and reports every match. The idea dates to 1951, when mathematician Stephen Cole Kleene formalized the concept of a regular language, but today regex is everyday plumbing in text editors, programming languages, and web servers.

What the common regex symbols mean

The engine scans the text for any stretch of characters that satisfies the pattern; these symbols define what qualifies:

• . matches any single character.
• * repeats the previous token zero or more times; + requires one or more.
• ? makes the previous token optional.
• [] matches one character from a set, so [a-z] means any lowercase letter.
• ^ and $ anchor the pattern to the start and end of the string.
• \d matches a digit, and \w matches a word character: a letter, digit, or underscore.
• {n} and {n,m} set repetition counts, so \d{5} means exactly 5 digits.

Example: validating a US ZIP code

The pattern ^\d{5}(-\d{4})?$ checks a US ZIP code. Token by token: ^ anchors the match to the start of the input, \d{5} requires exactly 5 digits, (-\d{4})? optionally allows a hyphen plus 4 more digits, and $ anchors the end so nothing else can follow.

So 90210 matches, and so does 90210-1234. But 9021 fails with only 4 digits, and 90210-12 fails because the optional group needs all 4 digits or none.

Where regex shows up on a website

Rewrite rules are the big one for site owners. In your .htaccess file, mod_rewrite compares every incoming URL against regex patterns (Apache uses the PCRE2 flavor). A single line like RewriteRule ^blog/(.*)$ /news/$1 [R=301,L] sets up a 301 redirect: (.*) captures whatever follows /blog/ and $1 reuses it in the new address. WordPress does the same job internally, turning your permalink settings into rewrite patterns it checks against each request.

Regex also powers form validation in PHP (the preg_match() function) and JavaScript (the built-in RegExp object), search and replace in most code editors, and command-line searches, where grep prints every line that matches a pattern. In Python, the job belongs to the re module in the standard library; the similarly named regex module is a separate third-party package, so import regex fails on a stock install.

To try it on your own site, start with rewrite rules: our beginner’s guide to the WordPress .htaccess file walks through editing the file safely.

Common regex failure modes

When a pattern misbehaves, one of three problems is usually to blame:

• Greedy matching: .* grabs the longest match it can find. When you want the shortest, add a question mark; .*? stops at the first opportunity.
• Flavor mismatch: syntax differs between engines. PHP and Apache use PCRE2, JavaScript and Python’s re module each follow their own rules, and grep and sed use POSIX syntax, so a pattern that passes in one tool can fail in your .htaccess file.
• Catastrophic backtracking: a pattern with nested repetition, such as (a+)+, can leave the engine churning for minutes on a long input. In validation code, that’s a performance problem and a denial-of-service risk.

Test every pattern in the environment it will actually run in. A free browser tester like regex101 lets you pick the flavor first (PCRE2 for a pattern headed to .htaccess) and explains each token as you type, which makes debugging a pattern much faster than trial and error on a live site.