621

I just want to create a regular expression out of any possible string.

var usersString = "Hello?!*`~World()[]";
var expression = new RegExp(RegExp.escape(usersString))
var matches = "Hello".match(expression);

Is there a built-in method for that? If not, what do people use? Ruby has RegExp.escape. I don't feel like I'd need to write my own, there have got to be something standard out there.

5
  • 20
    Just wanted to update you fine folk that RegExp.escape is currently worked on and anyone who thinks they have valuable input is very welcome to contribute. core-js and other polyfills offer it. Jun 14, 2015 at 22:48
  • 9
    According to the recent update of this answer this proposal was rejected: See the issue Jul 19, 2017 at 10:15
  • 1
    Yeah I believe @BenjaminGruenbaum may be the one who put forward the proposal. I tried to get code examples plus the es-shim npm module into an answer on stack overflow here: [ stackoverflow.com/a/63838890/5979634 ] because the proposal was eventually, unfortunately, rejected. Hopefully they change their minds or someone implements 'template tags' before I retire. Sep 13, 2020 at 10:13
  • 1
    The aforementioned proposal has just advanced to stage 2
    – urish
    Sep 28, 2023 at 19:50
  • 1
    2023 is coming to the end but most popular string-focused language doesn't have built in for the regexp escape. This never stops amuse me.
    – ruX
    Dec 2, 2023 at 14:32

20 Answers 20

803

The function linked in another answer is insufficient. It fails to escape ^ or $ (start and end of string), or -, which in a character group is used for ranges.

Use this function:

function escapeRegex(string) {
    return string.replace(/[/\-\\^$*+?.()|[\]{}]/g, '\\$&');
}

While it may seem unnecessary at first glance, escaping - (as well as ^) makes the function suitable for escaping characters to be inserted into a character class as well as the body of the regex.

Escaping / makes the function suitable for escaping characters to be used in a JavaScript regex literal for later evaluation.

As there is no downside to escaping either of them, it makes sense to escape to cover wider use cases.

And yes, it is a disappointing failing that this is not part of standard JavaScript.

31
  • 23
    actually, we don't need to escape / at all
    – thorn0
    Feb 14, 2013 at 20:53
  • 42
    @Paul: Perl quotemeta (\Q), Python re.escape, PHP preg_quote, Ruby Regexp.quote...
    – bobince
    Oct 3, 2013 at 10:24
  • 19
    If you are going to use this function in a loop, it's probably best to make the RegExp object it's own variable var e = /[\-\[\]\/\{\}\(\)\*\+\?\.\\\^\$\|]/g; and then your function is return s.replace(e, '\\$&'); This way you only instantiate the RegExp once.
    – styfle
    Oct 17, 2013 at 21:14
  • 41
    bobince cares not for eslint's opinion
    – bobince
    Sep 15, 2017 at 22:57
  • 11
    But maybe you want to escape characters to put them inside a character range. IMO better to harmlessly overescape than to underescape and cause problems in niche cases. FWIW personally I'd rather see the characters explicitly here; we're not playing code golf.
    – bobince
    Oct 12, 2017 at 20:54
194

For anyone using Lodash, since v3.0.0 a _.escapeRegExp function is built-in:

_.escapeRegExp('[lodash](https://lodash.com/)');
// → '\[lodash\]\(https:\/\/lodash\.com\/\)'

And, in the event that you don't want to require the full Lodash library, you may require just that function!

6
  • 8
    there's even an npm package of just this! npmjs.com/package/lodash.escaperegexp Nov 1, 2015 at 7:34
  • 2
    This imports loads of code that really doesn't need to be there for such a simple thing. Use bobince's answer... works for me and its so many less bytes to load than the lodash version!
    – Rob Evans
    Aug 31, 2017 at 13:20
  • 12
    @RobEvans my answer starts with "For anyone using lodash", and I even mention that you can require only the escapeRegExp function. Aug 31, 2017 at 13:24
  • 3
    @gustavohenke Sorry I should have been slightly more clear, I included the module linked to in your "just that function" and that is what I was commenting on. If you take a look it's quite a lot of code for what should effectively be a single function with a single regexp in it. Agree if you are already using lodash then it makes sense to use it, but otherwise use the other answer. Sorry for the unclear comment.
    – Rob Evans
    Aug 31, 2017 at 18:03
  • 2
    @maddob I cannot see that \x3 you mentioned: my escaped strings are looking good, just what I expect May 31, 2018 at 15:10
56

Most of the expressions here solve single specific use cases.

That's okay, but I prefer an "always works" approach.

function regExpEscape(literal_string) {
    return literal_string.replace(/[-[\]{}()*+!<=:?.\/\\^$|#\s,]/g, '\\$&');
}

This will "fully escape" a literal string for any of the following uses in regular expressions:

  • Insertion in a regular expression. E.g. new RegExp(regExpEscape(str))
  • Insertion in a character class. E.g. new RegExp('[' + regExpEscape(str) + ']')
  • Insertion in integer count specifier. E.g. new RegExp('x{1,' + regExpEscape(str) + '}')
  • Execution in non-JavaScript regular expression engines.

Special Characters Covered:

  • -: Creates a character range in a character class.
  • [ / ]: Starts / ends a character class.
  • { / }: Starts / ends a numeration specifier.
  • ( / ): Starts / ends a group.
  • * / + / ?: Specifies repetition type.
  • .: Matches any character.
  • \: Escapes characters, and starts entities.
  • ^: Specifies start of matching zone, and negates matching in a character class.
  • $: Specifies end of matching zone.
  • |: Specifies alternation.
  • #: Specifies comment in free spacing mode.
  • \s: Ignored in free spacing mode.
  • ,: Separates values in numeration specifier.
  • /: Starts or ends expression.
  • :: Completes special group types, and part of Perl-style character classes.
  • !: Negates zero-width group.
  • < / =: Part of zero-width group specifications.

Notes:

  • / is not strictly necessary in any flavor of regular expression. However, it protects in case someone (shudder) does eval("/" + pattern + "/");.
  • , ensures that if the string is meant to be an integer in the numerical specifier, it will properly cause a RegExp compiling error instead of silently compiling wrong.
  • #, and \s do not need to be escaped in JavaScript, but do in many other flavors. They are escaped here in case the regular expression will later be passed to another program.

If you also need to future-proof the regular expression against potential additions to the JavaScript regex engine capabilities, I recommend using the more paranoid:

function regExpEscapeFuture(literal_string) {
    return literal_string.replace(/[^A-Za-z0-9_]/g, '\\$&');
}

This function escapes every character except those explicitly guaranteed not be used for syntax in future regular expression flavors.


For the truly sanitation-keen, consider this edge case:

var s = '';
new RegExp('(choice1|choice2|' + regExpEscape(s) + ')');

This should compile fine in JavaScript, but will not in some other flavors. If intending to pass to another flavor, the null case of s === '' should be independently checked, like so:

var s = '';
new RegExp('(choice1|choice2' + (s ? '|' + regExpEscape(s) : '') + ')');
8
  • 1
    The / doesn't need to be escaped in the [...] character class. Jul 4, 2017 at 11:32
  • 1
    Most of these doesn't need to be escaped. "Creates a character range in a character class" - you are never in a character class inside of the string. "Specifies comment in free spacing mode, Ignored in free spacing mode" - not supported in javascript. "Separates values in numeration specifier" - you are never in numerarion specifier inside of the string. Also you can't write arbitrary text inside of nameration specification. "Starts or ends expression" - no need to escape. Eval is not a case, as it would require much more escaping. [will be continued in the next comment]
    – Qwertiy
    Sep 22, 2017 at 14:01
  • "Completes special group types, and part of Perl-style character classes" - seems not available in javascript. "Negates zero-width group, Part of zero-width group specifications" - you never have groups inside of the string.
    – Qwertiy
    Sep 22, 2017 at 14:01
  • 1
    @Qwertiy The reason for these extra escapes is to eliminate edge cases which could cause problems in certain use cases. For instance, the user of this function may want to insert the escaped regex string into another regex as part of a group, or even for use in another language besides Javascript. The function does not make assumptions like "I will never be part of a character class", because it's meant to be general. For a more YAGNI approach, see any of the other answers here. Sep 22, 2017 at 20:14
  • Very good. Why is _ not escaped though? What ensures it probably won't become regex syntax later?
    – madprops
    Oct 29, 2017 at 11:43
49

Mozilla Developer Network's Guide to Regular Expressions provides this escaping function:

function escapeRegExp(string) {
  return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); // $& means the whole matched string
}
0
22

In jQuery UI's autocomplete widget (version 1.9.1) they use a slightly different regular expression (line 6753), here's the regular expression combined with bobince's approach.

RegExp.escape = function( value ) {
     return value.replace(/[\-\[\]{}()*+?.,\\\^$|#\s]/g, "\\$&");
}
4
  • 4
    The only difference is that they escape , (which is not a metacharacter), and # and whitespace which only matter in free-spacing mode (which is not supported by JavaScript). However, they do get it right not to escape the the forward slash. Jul 8, 2013 at 10:22
  • 20
    If you want to reuse jquery UI's implementation rather than paste the code locally, go with $.ui.autocomplete.escapeRegex(myString). Aug 19, 2013 at 18:37
  • 3
    lodash has this too, _. escapeRegExp and npmjs.com/package/lodash.escaperegexp Nov 1, 2015 at 7:35
  • v1.12 the same, ok! Mar 7, 2017 at 3:27
17

There is an ES7 proposal for RegExp.escape at https://github.com/benjamingr/RexExp.escape/, with a polyfill available at https://github.com/ljharb/regexp.escape.

3
  • 14
    Looks like this didn't make it into ES7. It also looks like it was rejected in favor of looking for a template tag.
    – John
    Apr 29, 2017 at 7:30
  • 1
    @John yeah this looks like the case, at which point the entire concept has been abandoned for at least 5 years. I've added an example here, as it probably should have been implemented and TC39 still hasn't implemented their 'tag' based solution. This seems more in-line with getting what you expect, although I could also see it as a String.prototype method. At some point they should reconsider and implement this, even if they get around to parameterized regex. Most other languages impl escape though, even if they have parameterized queries, so we'll see. Sep 7, 2020 at 16:00
  • I have added code examples based on this proposal. Thank you for adding this answer that led me to the proposal. I attempted to edit this answer to add exact examples, but this was rejected by the mods. Here is the answer with code examples: [ stackoverflow.com/a/63838890/5979634 ] Sep 13, 2020 at 10:11
15

Nothing should prevent you from just escaping every non-alphanumeric character:

usersString.replace(/(?=\W)/g, '\\');

You lose a certain degree of readability when doing re.toString() but you win a great deal of simplicity (and security).

According to ECMA-262, on the one hand, regular expression "syntax characters" are always non-alphanumeric, such that the result is secure, and special escape sequences (\d, \w, \n) are always alphanumeric such that no false control escapes will be produced.

4
  • 1
    Simple and effective. I like this much better than the accepted answer. For (really) old browsers, .replace(/[^\w]/g, '\\$&') would work in the same way. Aug 10, 2017 at 7:20
  • 8
    This fails in Unicode mode. For example, new RegExp('🍎'.replace(/(?=\W)/g, '\\'), 'u') throws exception because \W matches each code unit of a surrogate pair separately, resulting in invalid escape codes. Feb 2, 2018 at 10:29
  • 2
    alternative: .replace(/\W/g, "\\$&"); Mar 21, 2018 at 14:34
  • 1
    @AlexeyLebedev Hes the answer been fixed to handle Unicode mode? Or is there a solution elsewhere which does, while maintaining this simplicity?
    – johny why
    Apr 26, 2020 at 21:07
12

There is an ES7 proposal for RegExp.escape at https://github.com/benjamingr/RexExp.escape/, with a polyfill available at https://github.com/ljharb/regexp.escape.

An example based on the rejected ES proposal, includes checks if the property already exists, in the case that TC39 backtracks on their decision.


Code:

if (!Object.prototype.hasOwnProperty.call(RegExp, 'escape')) {
  RegExp.escape = function(string) {
    // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#Escaping
    // https://github.com/benjamingr/RegExp.escape/issues/37
    return string.replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&'); // $& means the whole matched string
  };
}

Code Minified:

Object.prototype.hasOwnProperty.call(RegExp,"escape")||(RegExp.escape=function(e){return e.replace(/[.*+\-?^${}()|[\]\\]/g,"\\$&")});

// ...
var assert = require('assert');
 
var str = 'hello. how are you?';
var regex = new RegExp(RegExp.escape(str), 'g');
assert.equal(String(regex), '/hello\. how are you\?/g');

There is also an npm module at: https://www.npmjs.com/package/regexp.escape


One can install this and use it as so:


npm install regexp.escape

or

yarn add regexp.escape

var escape = require('regexp.escape');
var assert = require('assert');
 
var str = 'hello. how are you?';
var regex = new RegExp(escape(str), 'g');
assert.equal(String(regex), '/hello\. how are you\?/g');

In the GitHub && NPM page are descriptions of how to use the shim/polyfill for this option, as well. That logic is based on return RegExp.escape || implementation;, where implementation contains the regexp used above.


The NPM module is an extra dependency, but it also make it easier for an external contributor to identify logical parts added to the code. ¯\(ツ)

1
  • 1
    This answer begins identically to [ stackoverflow.com/a/30852428/5979634 ], I had hoped to edit their answer to include this information, but a simpler version of this was considered too different from the original answer. I figured I offered actual code examples within the website, but I'm not gonna argue. Instead, I've offered this as a new, expanded answer, seeing as it is too different from the one other answer like this. Sep 13, 2020 at 10:09
8

Another (much safer) approach is to escape all the characters (and not just a few special ones that we currently know) using the unicode escape format \u{code}:

function escapeRegExp(text) {
    return Array.from(text)
           .map(char => `\\u{${char.charCodeAt(0).toString(16)}}`)
           .join('');
}

console.log(escapeRegExp('a.b')); // '\u{61}\u{2e}\u{62}'

Please note that you need to pass the u flag for this method to work:

var expression = new RegExp(escapeRegExp(usersString), 'u');
1
  • Much safer! And ready future Regex implementations! Jul 27, 2020 at 18:00
5

This is a shorter version.

RegExp.escape = function(s) {
    return s.replace(/[$-\/?[-^{|}]/g, '\\$&');
}

This includes the non-meta characters of %, &, ', and ,, but the JavaScript RegExp specification allows this.

9
  • 3
    I wouldn't use this "shorter" version, since the character ranges hide the list of characters, which makes it harder to verify the correctness at first glance.
    – nhahtdh
    Nov 27, 2014 at 3:03
  • @nhahtdh I probably wouldn't either, but it is posted here for information.
    – kzh
    Nov 27, 2014 at 12:15
  • @kzh: posting "for information" helps less than posting for understanding. Would you not agree that my answer is clearer? Nov 27, 2014 at 21:14
  • At least, . is missed. And (). Or not? [-^ is strange. I don't remember what is there.
    – Qwertiy
    Sep 22, 2017 at 20:35
  • Those are in the specified range.
    – kzh
    Sep 22, 2017 at 21:15
4

XRegExp has an escape function:

XRegExp.escape('Escaped? <.>'); // -> 'Escaped\?\ <\.>'

More on: http://xregexp.com/api/#escape

4
escapeRegExp = function(str) {
  if (str == null) return '';
  return String(str).replace(/([.*+?^=!:${}()|[\]\/\\])/g, '\\$1');
};
3

Rather than only escaping characters which will cause issues in your regular expression (e.g.: a blacklist), consider using a whitelist instead. This way each character is considered tainted unless it matches.

For this example, assume the following expression:

RegExp.escape('be || ! be');

This whitelists letters, number and spaces:

RegExp.escape = function (string) {
    return string.replace(/([^\w\d\s])/gi, '\\$1');
}

Returns:

"be \|\| \! be"

This may escape characters which do not need to be escaped, but this doesn't hinder your expression (maybe some minor time penalties - but it's worth it for safety).

1
1

There has only ever been and ever will be 12 meta characters that need to be escaped to be considered a literal.

It doesn't matter what is done with the escaped string, inserted into a balanced regex wrapper or appended. It doesn't matter.

Do a string replace using this

var escaped_string = oldstring.replace(/[\\^$.|?*+()[{]/g, '\\$&');
4
  • 1
    what about ]? Oct 5, 2019 at 23:36
  • Not need to be escaped, if you use a sane parser.
    – AnrDaemon
    Mar 30, 2023 at 17:48
  • We don't need to escape closing ] (or }) if the opening [ (or {) is escaped. Is not the same true for ) ? Aug 19, 2023 at 6:42
  • My comment should be Why is not the same true for ) ? Aug 19, 2023 at 7:22
1

I borrowed bobince's answer above and created a tagged template function for creating a RegExp where part of the value is escaped and part isn't.

regex-escaped.js

RegExp.escape = text => text.replace(/[\-\[\]{}()*+?.,\\\^$|#\s]/g, '\\$&');

RegExp.escaped = flags =>
  function (regexStrings, ...escaped) {
    const source = regexStrings
      .map((s, i) =>
        // escaped[i] will be undefined for the last value of s
        escaped[i] === undefined
          ? s
          : s + RegExp.escape(escaped[i].toString())
      )
      .join('');
    return new RegExp(source, flags);
  };
  
function capitalizeFirstUserInputCaseInsensitiveMatch(text, userInput) {
  const [, before, match, after ] =
    RegExp.escaped('i')`^((?:(?!${userInput}).)*)(${userInput})?(.*)$`.exec(text);

  return `${before}${match.toUpperCase()}${after}`;
}

const text = 'hello (world)';
const userInput = 'lo (wor';
console.log(capitalizeFirstUserInputCaseInsensitiveMatch(text, userInput));

For our TypeScript fans...

global.d.ts

interface RegExpConstructor {
  /** Escapes a string so that it can be used as a literal within a `RegExp`. */
  escape(text: string): string;

  /**
   * Returns a tagged template function that creates `RegExp` with its template values escaped.
   *
   * This can be useful when using a `RegExp` to search with user input.
   *
   * @param flags The flags to apply to the `RegExp`.
   *
   * @example
   *
   * function capitalizeFirstUserInputCaseInsensitiveMatch(text: string, userInput: string) {
   *   const [, before, match, after ] =
   *     RegExp.escaped('i')`^((?:(?!${userInput}).)*)(${userInput})?(.*)$`.exec(text);
   *
   *   return `${before}${match.toUpperCase()}${after}`;
   * }
   */
  escaped(flags?: string): (regexStrings: TemplateStringsArray, ...escapedVals: Array<string | number>) => RegExp;
}
1
0

The functions in the other answers are overkill for escaping entire regular expressions (they may be useful for escaping parts of regular expressions that will later be concatenated into bigger regexps).

If you escape an entire regexp and are done with it, quoting the metacharacters that are either standalone (., ?, +, *, ^, $, |, \) or start something ((, [, {) is all you need:

String.prototype.regexEscape = function regexEscape() {
  return this.replace(/[.?+*^$|({[\\]/g, '\\$&');
};

And yes, it's disappointing that JavaScript doesn't have a function like this built-in.

7
  • 1
    Let's say you escape the user input (text)next and insert it in: (?: + input + ). Your method will give the resulting string (?:\(text)next) which fails to compile. Note that this is quite a reasonable insertion, not some crazy one like re\ + input + re (in this case, the programmer can be blamed for doing something stupid)
    – nhahtdh
    Nov 27, 2014 at 2:58
  • 1
    @nhahtdh: my answer specifically mentioned escaping entire regular expressions and "being done" with them, not parts (or future parts) of regexps. Kindly undo the downvote? Nov 27, 2014 at 21:08
  • 1
    It's rarely the case that you would escape the entire expression - there are string operation, which are much faster compared to regex if you want to work with literal string.
    – nhahtdh
    Nov 28, 2014 at 1:24
  • 2
    Please address the part about closing )
    – nhahtdh
    Nov 28, 2014 at 4:22
  • 1
    It would be right to escape closing braces too, even if they are allowed by some dialect. As I remember, that's an extension, not a rule.
    – Qwertiy
    Sep 22, 2017 at 20:34
0

This one is the permanent solution.

function regExpEscapeFuture(literal_string) {
     return literal_string.replace(/[^A-Za-z0-9_]/g, '\\$&');
}
0

Just published a regex escape gist based on the RegExp.escape shim which was in turn based on the rejected RegExp.escape proposal. Looks roughly equivalent to the accepted answer except it doesn't escape - characters, which seems to be actually fine according to my manual testing.

Current gist at the time of writing this:

const syntaxChars = /[\^$\\.*+?()[\]{}|]/g

/**
 * Escapes all special special regex characters in a given string
 * so that it can be passed to `new RegExp(escaped, ...)` to match all given
 * characters literally.
 *
 * inspired by https://github.com/es-shims/regexp.escape/blob/master/implementation.js
 *
 * @param {string} s
 */
export function escape(s) {
  return s.replace(syntaxChars, '\\$&')
}
0

If you are a VS Code user, you can use the Replace command with regex already enabled (press Alt+R to toggle regex mode).

For example, we can escape console.log(42);:

enter image description here

Simply select a span of text and press Ctrl+H (or Ctrl+Shift+H for Search: Replace in Files).

The editor will automatically escape the selected text.

Tested with VS Code v1.87.2

0

Here is a replaceAll version.

Uses the string.includes function and a ternary to add the escape backslash instead of a regex.

const escapeRegexNonRegex = s => s.split('').map(a => "/-^$*+?.|()[]{}".includes(a) ? "\\" + a : a).join('');

const escapeRegex = s => s.replaceAll(/./g, a => "/-^$*+?.|()[]{}".includes(a) ? "\\" + a : a);

const usersString = "\\/-^$*+?.|()[]{}Hello";

const escapedString = escapeRegex(usersString);

const expression = new RegExp(escapedString);

const matches = usersString.match(expression);

console.log(matches);

3
  • Can you give an example of how this works ?
    – kofifus
    Feb 16 at 2:57
  • 1
    Good catch. It didn't. I presumed the "" worked in replaceAll as in split. Must have tested a split version then shortened it obviously without testing. Thanks Feb 29 at 15:22
  • doesn't look "non regex based"
    – kofifus
    Feb 29 at 21:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.