PHP preg functions apply PCRE patterns to bounded text through anchors, groups, properties, captures, matches, splits, and replacements. Regex is one parser choice, not proof of domain validity or a substitute for hierarchical parsers.
Reliable patterns quote dynamic literals, validate UTF-8, distinguish no-match from engine failure, bound subjects and repetition, avoid catastrophic backtracking, and test adversarial near misses with explicit runtime ceilings.
<?php
$slug = 'php-regex-guide';
$isValid = preg_match('/\A[a-z0-9]+(?:-[a-z0-9]+)*\z/D', $slug) === 1;
echo $isValid ? 'Valid' : 'Invalid';ValidThe anchors require the complete string to follow the slug rule.
<?php
$line = 'level=warning code=42';
$matched = preg_match(
'/level=(?<level>[a-z]+)\s+code=(?<code>\d+)/',
$line,
$matches
);
if ($matched === 1) {
echo $matches['level'] . ':' . $matches['code'];
}warning:42When literal user text becomes part of a pattern, escape it with preg_quote(). Choose the same delimiter that the final pattern uses.
<?php
$needle = 'price (USD)';
$pattern = '/' . preg_quote($needle, '/') . '/i';
$text = 'Show PRICE (USD) on the receipt.';
echo preg_match($pattern, $text) === 1 ? 'Found' : 'Missing';Foundpreg_replace() returns null on error. preg_match() returns 1 for a match, 0 for no match, and false on failure. Check these states strictly when a pattern can fail.
<?php
$clean = preg_replace('/\s+/', ' ', trim('PHP regex guide'));
if ($clean === null) {
throw new RuntimeException('Regex replacement failed.');
}
echo $clean;PHP regex guideAnchor a validation pattern when the entire string must match, choose Unicode mode intentionally, and check preg_last_error_msg when preg_match returns false. Limit untrusted input length before applying complex patterns because catastrophic backtracking can consume excessive CPU.
Use named capture groups when extracted fields have meaning, and quote literal user text with preg_quote before inserting it into a pattern. Test empty input, boundary lengths, Unicode cases, and a deliberately near-matching failure, not only one happy sample.
PHP preg functions use PCRE patterns for text whose structure is regular enough to describe with literals, classes, groups, alternatives, assertions, and repetition. Prefer direct string functions for exact search, prefix, suffix, split, or literal replacement because they express that intent more clearly.
Do not use one enormous pattern to parse HTML, programming languages, or deeply nested formats when a parser exists. A regex can recognize a bounded token or local rule while the parser owns hierarchy, escaping, and error recovery.
Write the accepted language before the pattern: allowed characters, minimum and maximum length, anchors, case policy, line behavior, and Unicode expectations. A pattern without an explicit input contract is difficult to review for missing cases.
Treat a request-provided pattern as executable logic with denial-of-service risk. Most features should select from application-owned patterns rather than compile arbitrary user syntax.
A successful match validates only the represented syntax. Email ownership, URL destination safety, date validity, authorization, and business uniqueness need separate checks.
PHP patterns use delimiters around the PCRE expression. Choose a delimiter that minimizes escaping and escape a dynamic literal fragment with `preg_quote` using the same delimiter. Never insert raw user text into pattern syntax.
Anchors constrain where a match may occur. Use whole-subject anchors when validating an entire field, and understand multiline modifiers before relying on caret and dollar. A substring match is not whole-value validation.
Character classes describe one character position; alternation describes alternatives; quantifiers describe repetition. Bound quantifiers when the domain has a maximum and group alternatives so anchors apply to every branch.
Use non-capturing groups when grouping is structural and named captures when the result has fields. Numbered captures become fragile when an earlier group is inserted during maintenance.
Extended mode can add whitespace and comments to complex patterns, but literal spaces and hash characters then need deliberate handling. Keep the pattern beside tests and a plain-language contract.
PHP strings are bytes, while the `u` modifier asks PCRE to treat pattern and subject as UTF-8. Use it for Unicode text and validate incoming encoding first; invalid UTF-8 can produce a match error rather than an ordinary no-match result.
ASCII ranges such as `[A-Z]` do not represent every letter. Unicode property escapes can describe letters, numbers, marks, and scripts when the product rule truly accepts them. Avoid restricting human names to a small Western character set.
Case-insensitive Unicode matching can include equivalences unfamiliar to users. PHP 8.4 adds the `r` modifier for a more restricted ASCII/non-ASCII case-folding boundary; label that syntax by minimum version before using it.
A code point is not always a user-perceived character. Combining marks and multi-code-point graphemes affect length and cursor expectations, so use internationalization APIs when the rule is about visible characters.
Normalization can make visually equivalent strings use different code-point sequences. Normalize at a clearly defined boundary only when the domain needs canonical comparison and preserve original display data where required.
`preg_match` reports one match, no match, or failure; use strict comparisons so zero is not confused with an error. Inspect `preg_last_error_msg()` or the error code when the function reports failure.
`preg_match_all` returns all matches and can organize captures by pattern or by match. Select flags deliberately and limit subject bytes and expected result count before materializing a large match matrix.
Optional captures may be absent or unmatched. Use flags and key checks appropriate to the desired result rather than assuming every capture contains a non-empty string.
Offset capture reports byte offsets, even for UTF-8 subjects. Do not use those offsets directly as visible-character positions without conversion through an encoding-aware operation.
`preg_grep` filters array values, while `preg_split` tokenizes by a pattern. Preserve keys, empty pieces, offsets, and limits only when the downstream contract expects them.
`preg_replace` interprets replacement references such as captured groups, while `preg_replace_callback` computes output in PHP. Use a callback when logic, escaping, or ambiguous reference boundaries would make a replacement string unclear.
A literal search-and-replace belongs in `str_replace` or `str_ireplace`, not a regex. Simpler tools avoid pattern compilation and special replacement semantics.
Limit replacements when only a bounded number should change and inspect the replacement count when success depends on finding a match. An unchanged string can mean no match or replacement with equivalent text.
Never use removed or dangerous evaluation-style replacement behavior. A callback still receives untrusted text, so encode for the final HTML, URL, SQL, or command context after transformation.
A replacement operation can return null on error. Check the result before persisting or sending it; otherwise a pattern failure may become missing data.
Nested ambiguous quantifiers and overlapping alternatives can cause excessive backtracking on near-matching input. Reduce ambiguity, anchor early, bound repetition, and prefer atomic or possessive techniques only after understanding their changed matching behavior.
PHP and PCRE impose backtrack, recursion, and JIT stack limits. Hitting a limit is an execution error, not a valid no-match. Log the safe pattern identifier and error category while returning a bounded application response.
Restrict subject length before matching. A theoretically linear pattern can still consume unacceptable work on an unlimited request, log, or uploaded document.
Test valid examples, every boundary, empty input, invalid UTF-8, adversarial repeated prefixes, near misses, and maximum bytes. Add a runtime ceiling to performance tests so a regression cannot hang the suite.
Benchmark the complete operation with representative data instead of comparing pattern cleverness. A parser or two-stage literal check plus regex can be clearer and faster than one universal expression.
0 of 2 checked
Try this next
0 of 2 completed
Explore 500+ free tutorials across 20+ languages and frameworks.