Escaping Special Characters in Regular Expressions

Regular Expression Escaping

Regular expressions use many characters as metacharacters with special meanings. To match these characters literally, they must be escaped with a backslash. The challenge is compounded when regex patterns are written inside string literals, creating multiple layers of escaping.

Regex Metacharacters

These characters have special meaning in regex and must be escaped with \\ to match literally:

.   → any character
*   → zero or more
+   → one or more
?   → zero or one
^   → start of string / negation in character class
$   → end of string
|   → alternation (OR)
\\   → escape character
{   → quantifier start
}   → quantifier end
[   → character class start
]   → character class end
(   → group start
)   → group end

The Double-Escaping Problem

When a regex is written as a string literal, backslashes must be escaped for the string layer, then for the regex layer:

// Match a literal dot
const re1 = /\./;                        // regex literal — one backslash
const re2 = new RegExp("\\.");           // string — doubled

// Match a literal backslash
const re3 = /\\\\/;                        // regex literal — two backslashes
const re4 = new RegExp("\\\\\\\\");           // string — four backslashes!

Escaping Inside Character Classes

Inside [...], fewer characters are special:

• ] closes the class — escape as \\]
• \\ is still the escape character
• ^ is negation when first — escape as \\^
• - is a range operator — escape as \\- or place at start/end

Characters like ., *, +, ( lose their special meaning inside character classes and do not need escaping.

Language Escape Functions

Most languages provide utility functions to escape arbitrary strings for regex use:

// JavaScript — no built-in, common polyfill:
function escapeRegex(s) {
  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
}

// Python
import re
re.escape("price: $10.00")  # "price:\\ \\$10\\.00"

// Java
Pattern.quote("a.b*c")      # "\\Qa.b*c\\E"

// PHP
preg_quote("a.b*c", "/")    # "a\\.b\\*c"

Common Pitfalls

• Forgetting to escape dots: \\. vs . — an unescaped dot matches any character, producing false matches.
• Escaping too much: In character classes, [\.] and [.] are equivalent — the escape is harmless but unnecessary.
• Regex inside JSON: Three layers of escaping (JSON string → language string → regex) can require eight backslashes to match one literal backslash.