Regular Expressions for Beginners

What is a Regular Expression?

A regular expression (regex) is a formal sequence of characters defining a search pattern. Developed from theoretical computer science and formal language theory by Stephen Cole Kleene in the 1950s, regular expressions provide a declarative syntax to search, match, validate, and replace textual substrings efficiently.

Core Syntax and Metacharacters

Quantifiers: Greedy vs. Lazy Matching

Quantifiers determine how many times a preceding token may repeat:

• *: 0 or more occurrences.
• +: 1 or more occurrences.
• ?: 0 or 1 occurrence (optional).
• {n,m}: Between n and m occurrences.

By default, quantifiers are greedy: they consume as much text as possible while still allowing the pattern to match. Appending a question mark (e.g., *? or +?) makes the quantifier lazy (or reluctant), causing it to stop matching at the earliest possible boundary.

Capturing Groups and Non-Capturing Groups

Enclosing part of a pattern in parentheses (abc) creates a capturing group, allowing you to extract specific matched values or backreference them later. If you only need parentheses for logical alternation without the overhead of capturing, use a non-capturing group: (?:abc).

Guarding Against ReDoS (Catastrophic Backtracking)

Most programming languages use NFA (Nondeterministic Finite Automaton) regex engines that rely on backtracking. When evaluating ambiguous patterns with nested quantifiers (such as (a+)+$) against non-matching input strings like aaaaaaaaaaaaaaaaaaaa!, the engine tests every combinatorial variation. This causes execution time to explode exponentially, freezing the CPU thread in what is termed a Regular Expression Denial of Service (ReDoS). Always audit regex patterns for overlapping quantifiers.

Frequently Asked Questions About Regular Expressions

What are lookaround assertions in regex?

Lookarounds are zero-length assertions that match a character pattern without including it in the matched result:

• Positive Lookahead ((?=...)): Asserts that the pattern matches immediately following the current position.
• Negative Lookahead ((?!...)): Asserts that the pattern does NOT match following the current position.
• Positive Lookbehind ((?<=...)): Asserts that the pattern matches immediately preceding the current position.
• Negative Lookbehind ((?<!...)): Asserts that the pattern does NOT match preceding the current position.

Why should you not use regex to parse HTML?

Regular expressions are mathematically designed to parse regular languages (Chomsky Type 3 grammars). HTML is a context-free language (Chomsky Type 2) characterized by arbitrary, recursive tag nesting, unquoted attributes, and conditional comments. Attempting to parse nested HTML elements with regular expressions inevitably fails on edge cases. Always use proper DOM parsers (such as DOMParser in browsers or Cheerio/BeautifulSoup) for HTML processing.

How do I test regex performance?

To avoid ReDoS vulnerabilities in production, use regex benchmarking tools, ensure pattern quantifiers do not overlap, and set execution timeout boundaries when evaluating user-supplied patterns in server environments.