Regular Expressions for Beginners — Common Patterns and Syntax

A regular expression (regex) is a small language for describing patterns in text with a short expression. It is widely used wherever you handle text: searching, extracting, replacing, and validating input. This article organizes the basic building blocks — character classes, metacharacters, quantifiers, groups, anchors, and flags — and then covers simple patterns for email, phone, URL and date, along with pitfalls such as ReDoS, all based on JavaScript syntax.

1. What a regular expression is

A regular expression represents a condition on text — such as "three digits in a row" or "something that looks like an email containing @" — as an expression built from symbols. In JavaScript you create one with a /pattern/flags literal, or with new RegExp("pattern", "flags").

For example, to simply look for the sequence "cat", you write /cat/. A part made of plain characters matches those characters themselves. The main uses are as follows.

• Searching / testing: /cat/.test("category") returns true if it is contained.
• Extracting: "a1b2".match(/\d/g) pulls out the matches as ["1","2"].
• Replacing: "a-b-c".replace(/-/g, "_") yields "a_b_c".

From here, we look in turn at the meaning of the symbols (metacharacters) that make up a pattern. When you want to strip a symbol's special meaning and treat it as "just a character", place a \ (backslash) before it to escape it. For instance, to represent a literal ., write \..

2. Basic building blocks — character classes, metacharacters, quantifiers

The foundation of regex is the symbols that express "which characters" to match and "how many". Let us go through them in order.

Character classes [ ] and \d \w \s

A character class lists candidates inside [ ] and matches any one of them. Use - for a range and a leading ^ for negation.

• [abc] … any one of a, b, or c.
• [a-z] … one lowercase letter (range specification).
• [^0-9] … one non-digit character (the leading ^ negates).

Commonly used character classes have shorthand forms. Uppercasing them gives "the negation".

Metacharacters . ^ $

Metacharacters are symbols with special meaning. Here are the representative ones.

• . … any single character (excluding newline by default). To represent a literal ., escape it as \..
• ^ … an anchor for the start of the line (string) (see below).
• $ … an anchor for the end of the line (string) (see below).
• | … "or". cat|dog matches either cat or dog.

Quantifiers * + ? {n,m}

Quantifiers express how many times the preceding element repeats.

Greedy and lazy matching

Quantifiers are greedy by default and match as much as possible while still satisfying the pattern. Adding ? right after them makes them lazy, matching as little as possible.

• When the target string is <a><b>, the greedy <.+> grabs everything from the first < to the last >, that is, the whole <a><b>.
• The lazy <.+?> stops at the first > and matches only <a>.

3. Groups and capturing — ( ), backreferences, named

Parentheses ( ) bundle several elements into one unit. You can apply a quantifier to the whole group, and groups also capture (extract) the matched part.

• Grouping: (ab)+ is one or more repetitions of ab (ab, abab …).
• Capturing: (\d{4})-(\d{2}) captures the year into the first parentheses and the month into the second. You can reference them in the match result array or in a callback.
• Non-capturing: when you only need grouping and not extraction, write (?:...). (?:ab)+ bundles the repetition without capturing.

Backreferences

Captured content can be backreferenced within the same pattern as \1, \2 … (numbered by the order the parentheses appear). It is used to express a repetition of a string that appeared earlier.

• (\w)\1 … the same word character twice in a row (such as oo).
• They also work in replacement; in JavaScript's replace replacement string you use the notation $1, $2.

Named captures

Giving a name instead of a number improves readability. Capture with (?<name>...) and retrieve it by name from groups in the match result. A backreference within the same pattern is \k<name>, and in the replacement string it is $<name>.

Example: (?<year>\d{4})-(?<month>\d{2}) lets you retrieve the year and month via groups.year and groups.month.

4. Anchors and boundaries — ^ $ \b

Anchors match a "position" rather than a character itself. They are zero-width (they consume no characters).

• ^ … the start position. With the m flag it becomes the start of each line.
• $ … the end position. With the m flag it becomes the end of each line.
• \b … a word boundary. It matches the boundary between a word character (\w) and a non-word character (\W), or the edge of the string.
• \B … a position that is not a word boundary.

For example, ^\d+$ expresses the condition "the whole thing is only digits" (one or more digits from start to end). Without anchors it merely means "contains a digit somewhere", which is insufficient for input validation.

5. Flags — g i m s u

Flags are options that change the behavior of the whole pattern; in a literal you append them after the closing / (e.g. /abc/gi). Here are the representative ones.

For example, to "find all cat ignoring case", use /cat/gi. Flags can be combined and their order does not matter.

6. Common patterns — email, phone, URL, date

The table below collects simple patterns commonly seen in practice, combining the elements above. None of them are strict spec-compliant validations; they are practical rules of thumb only. When you truly need accurate validation (especially for email), pair them with a dedicated library or an actual delivery check.

7. Pitfalls — over-complication and ReDoS

Regex is powerful, but writing too much makes it unreadable and invites performance problems. Finally, here are practical pitfalls.

• Avoid over-complication: cramming everything into one expression makes it unreadable and unfixable later. It is also a sound choice to split it into multiple steps, add comments (in languages with an x flag), or delegate to a dedicated parser.
• Watch out for ReDoS (regex denial of service): patterns with nested quantifiers such as (a+)+ or (.*)* can cause backtracking to explode on certain inputs, making processing extremely slow. Places that pass external input straight into a complex pattern are especially dangerous.
• Mitigations: avoid nested quantifiers, limit the range with a character class such as [^>]+, and cap the input length where possible. Designing so that you never execute untrusted patterns also helps.

In short, the basics of regex are "keep it small, keep it readable, and verify with real examples". Master the four — character classes and quantifiers, anchors, and flags — and you can cover most everyday patterns.