Regular expressions: a first pass

Everything so far has searched for text you could type out in full: a comma, an @, the word 2026. A regular expression searches for text you can only DESCRIBE — four digits in a row, a word starting with a capital letter, anything between two angle brackets.

You write one between slashes rather than quotes: `/\d+/` is a pattern, not a string. Letters and digits in a pattern match themselves, so `/cat/` finds the letters c, a, t. The power comes from the handful of symbols that mean something else.

Reading them aloud is the skill. `/\d{4}/` is 'four digits'. `/^cat/` is 'cat, at the very start'. `/[chm]at/` is 'c or h or m, then a t'. If you can say a pattern in English you can usually fix it; if you cannot, you are guessing, and guessing at regular expressions is how they earn their reputation.

Character classes name a KIND of character. `\d` is any digit, `\w` is a letter, digit or underscore, `\s` is any whitespace. A dot means any character at all. Their capitals are the opposites: `\D` is any non-digit.

Square brackets make your own class: `[chm]` is any one of those three letters, `[a-z]` is any lower-case letter, and `[^0-9]` — with the caret INSIDE the brackets — is anything that is not a digit.

Quantifiers say how many. `+` is one or more, `*` is zero or more, `?` is zero or one (optional), and braces are exact: `{4}` is exactly four, `{2,4}` is between two and four, `{2,}` is two or more. A quantifier applies to the thing immediately before it, so `\d{4}` is four digits but `abc{2}` is ab followed by two c's.

Anchors pin the pattern to a place: `^` is the start of the text and `$` is the end. `/^\d+$/` means 'digits and nothing else', which is a completely different question from `/\d+/`, and confusing the two is a common source of sloppy validation.

Round brackets group — both for applying a quantifier to several characters at once and for capturing the part you want to keep. A vertical bar means or: `/(cat|dog)/`.

Finally, a backslash escapes a symbol that would otherwise mean something: `/\./` is a literal dot, not 'any character'.

Two flags go after the closing slash. `g` means find every match rather than stopping at the first; `i` means ignore capitalisation. `/cat/gi` is 'every cat, in any case'.

`pattern.test(text)` answers true or false. Reach for it when that is genuinely all you need.

`text.match(pattern)` behaves in two quite different ways depending on the flag. WITHOUT `g` it returns an array-like result describing the first match: position 0 is the whole match, positions 1 and up are the round-bracket groups, and `.index` is where it was found. WITH `g` it returns a plain array of every matching string and no group information at all.

Either way, `match` returns `null` when nothing matched — not an empty array. `text.match(/x/g)[0]` on text without an x throws a TypeError, and that is one of the most common runtime errors in text-handling code. Check for null, or use `matchAll`.

`text.matchAll(pattern)` needs the `g` flag and gives you every match WITH its groups and positions, as something you spread into an array: `[...text.matchAll(/(\d+)/g)]`. When you want every match and its parts, this is the modern answer.

`text.replace(pattern, replacement)` returns a new string — strings are still immutable — replacing the first match, or every match with the `g` flag. `replaceAll` does every match and, unlike replace, also accepts a plain string as the thing to find. If the replacement is a function, it is called with each match and its return value is used, which is how you transform rather than merely substitute.

`/<.+>/` looks like 'an angle bracket, some stuff, an angle bracket'. Run it on `<b>bold</b>` and it matches the WHOLE thing, not just `<b>`.

That is because `+` and `*` are greedy: they take as much as they possibly can and only give characters back if the rest of the pattern cannot otherwise match. The final `>` is happy to match the very last angle bracket in the text, so it does.

Adding a question mark makes a quantifier lazy — `+?` takes as little as it can. `/<.+?>/` matches just `<b>`, which is what you meant. Whenever a pattern is matching far more than you expected, greed is the first thing to check.

This one is genuinely surprising. A regular expression with the `g` flag carries a `lastIndex` property, and `test` both reads it and updates it — so calling `test` repeatedly on the SAME regular expression object walks through the string, returning true, true, true, then false, then true again.

It happens whenever you store a /g pattern in a variable or at the top of a file and call `.test()` on it in a loop. The results depend on how many times you have called it before, which is exactly the kind of bug that cannot be reproduced by staring at the failing line.

The fix is simple: do not put the `g` flag on a pattern you are using with `test`, since test only ever wants a yes or no. If you need the same pattern for both jobs, create it fresh where you use it, or reset `lastIndex` to 0 yourself.

If `split`, `indexOf` or `includes` already answers the question, use them. `text.includes("@")` is clearer than a pattern and impossible to get subtly wrong.

Do not use a regular expression to parse HTML, JSON or CSV. Those formats nest and quote and escape, and a pattern cannot count — every 'nearly working' regular expression for them fails on the day a value contains the character you assumed it never would. Use a parser.

Do not try to validate an email address with a pattern. The real rules are far stranger than any pattern you would write, and the practical test of an address is whether mail sent to it arrives. A rough check for one @ with something either side, then send a confirmation, is the honest approach.

Where regular expressions genuinely shine: finding and replacing structured fragments in prose, splitting on a variable separator such as `/\s+/`, tidying whitespace, and pulling known-shaped values — dates, reference codes, numbers — out of otherwise unstructured text.

Patterns go between slashes. Character classes say what kind, quantifiers say how many, anchors say where, brackets group and capture, and the g and i flags say every-match and ignore-case.

test gives a boolean, match gives the first match with its groups (or every matching string with /g, or null), matchAll gives everything with groups, replace and replaceAll give you a new string. Watch for greedy quantifiers, for null from match, and for a reused /g pattern in test.