v135 · javascript

RegExp.escape

RegExp.escape is a static method that takes a string and returns an escaped version that may be used as a pattern inside a regular expression. For example, copied from the proposal explainer: ``` const str = prompt("Please enter a string"); const escaped = RegExp.escape(str); const re = new RegExp(escaped, 'g'); // handles reg exp special tokens wit

concepts

  1. RegExp.escape

    RegExp.escape() — the long-missing safe escape function for user input in regexes. Type a string with metacharacters, watch the escaped pattern, then run it against a sample document.

  2. Dynamic Highlighter

    Multi-term highlighter built from user-supplied tokens — the motivating use case in the TC39 proposal. Naive concatenation throws or over-matches; RegExp.escape makes the combined alternation regex safe.

  3. Safe glob builder

    Type a glob-style pattern (with * wildcards) and watch it become a safe regex. A match table compares the escaped pattern to the unescaped version so you can see exactly which strings collapse under injection without RegExp.escape.

  4. Code injection fuzzer

    A curated list of nasty inputs — ReDoS-prone patterns, alternation bombs, lookbehinds — runs against three handlers. The table flags where naive concat over-matches or throws while RegExp.escape stays safe.

  5. URL route matcher

    Build path templates like /api/v1.0/users/:id and test them against real URLs. Without RegExp.escape, literal dots in version segments match any character — the router silently accepts /api/v1X0/users/42. Switch to "Escaped vs naive" to see each mismatch side by side.

why it shipped

To provide a standard method to escape strings for use inside regular expressions, which is a common use pattern and is error-prone due to a large number of corner cases.

references