Regex Escape

How to use the regex escape

1. Paste your text.
2. Copy the escaped pattern.
3. Use it in your regular expression.

About this tool

Escaping matters whenever a search term comes from a user or a file rather than from you. A full stop means &ldquo;any character&rdquo;, a bracket opens a group and a plus sign is a quantifier — so an unescaped search for <code>file (1).txt</code> either fails outright or matches things it should not.

Every character with special meaning is escaped, including the forward slash and hyphen. Neither strictly needs escaping in every position, but escaping them is always safe and removes the need to reason about which position you happen to be in.

The result is checked against your own input: the escaped pattern is compiled and tested to confirm it matches the original text exactly. That turns the claim into something demonstrated rather than asserted.

JavaScript is gaining a built-in <code>RegExp.escape</code> for this. Until it is available everywhere, escaping by hand is what most code does — and getting it wrong is a real source of injection bugs when the input is untrusted.

Common uses

• Searching for a filename or path that contains dots and brackets.
• Building a pattern from user input safely.
• Matching text that contains regex metacharacters literally.

Frequently asked questions

Why escape the forward slash?

It ends the pattern in /…/ literal syntax. It does not need escaping inside a RegExp constructor, but escaping it is harmless and saves you deciding.

Why does this matter for security?

Interpolating untrusted input into a pattern lets it change what the pattern means, and can create one that backtracks catastrophically. Escaping prevents both.

Is there a built-in for this?

RegExp.escape is being added to JavaScript. Until it is available everywhere, escaping by hand is what most code does.