Regular Expressions 101

Save & Share

Flavor

  • PCRE2 (PHP >=7.3)
  • PCRE (PHP <7.3)
  • ECMAScript (JavaScript)
  • Python
  • Golang
  • Java 8

Function

  • Match
  • Substitution
  • List
  • Unit Tests
/
^(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*<\?(?:php)?\s*.{0,120}\$_session\[['"]\w+['"]\]\s*=\s*\$_post\[['"]\w+['"]\].{0,120}\$md5=md5\("\$random"\);\s*\$base=base64_encode\(\$md5\);\s*\$host=md5\(.{0,50}\$logon="\w+\.html\?\$host\-\$host\-\$host\$host.{0,100}header\("location:\s*\$logon[[:punct:]\s]+$
/
gsi
^ asserts position at start of the string
Non-capturing group
(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*
* matches the previous token between zero and unlimited times, as many times as possible, giving back as needed (greedy)
1st Alternative
[[:^print:][:cntrl:]\s]
Match a single character present in the list below
[[:^print:][:cntrl:]\s]
[:^print:] matches the negation of print
[:cntrl:] matches a control character [\x00-\x1F\x7F]
\s matches any whitespace character (equivalent to [\r\n\t\f\v ])
2nd Alternative
GIF89.{0,20}
GIF89
matches the characters GIF89 literally (case insensitive)
.
matches any character
{0,20} matches the previous token between 0 and 20 times, as many times as possible, giving back as needed (greedy)
< matches the character < with index 6010 (3C16 or 748) literally (case insensitive)
\? matches the character ? with index 6310 (3F16 or 778) literally (case insensitive)
Non-capturing group
(?:php)?
? matches the previous token between zero and one times, as many times as possible, giving back as needed (greedy)
php
matches the characters php literally (case insensitive)
\s
matches any whitespace character (equivalent to [\r\n\t\f\v ])
* matches the previous token between zero and unlimited times, as many times as possible, giving back as needed (greedy)
.
matches any character
{0,120} matches the previous token between 0 and 120 times, as many times as possible, giving back as needed (greedy)
\$ matches the character $ with index 3610 (2416 or 448) literally (case insensitive)
_session
matches the characters _session literally (case insensitive)
\[ matches the character [ with index 9110 (5B16 or 1338) literally (case insensitive)
Match a single character present in the list below
['"]
'"
matches a single character in the list '" (case insensitive)
\w
matches any word character (equivalent to [a-zA-Z0-9_])
+ matches the previous token between one and unlimited times, as many times as possible, giving back as needed (greedy)
Match a single character present in the list below
['"]
'"
matches a single character in the list '" (case insensitive)
\] matches the character ] with index 9310 (5D16 or 1358) literally (case insensitive)
\s
matches any whitespace character (equivalent to [\r\n\t\f\v ])
* matches the previous token between zero and unlimited times, as many times as possible, giving back as needed (greedy)
= matches the character = with index 6110 (3D16 or 758) literally (case insensitive)
\s
matches any whitespace character (equivalent to [\r\n\t\f\v ])
* matches the previous token between zero and unlimited times, as many times as possible, giving back as needed (greedy)
\$ matches the character $ with index 3610 (2416 or 448) literally (case insensitive)
_post
matches the characters _post literally (case insensitive)
\[ matches the character [ with index 9110 (5B16 or 1338) literally (case insensitive)
Match a single character present in the list below
['"]
\w
matches any word character (equivalent to [a-zA-Z0-9_])
Match a single character present in the list below
['"]
\] matches the character ] with index 9310 (5D16 or 1358) literally (case insensitive)
.
matches any character
\$ matches the character $ with index 3610 (2416 or 448) literally (case insensitive)
md5=md5
matches the characters md5=md5 literally (case insensitive)
\( matches the character ( with index 4010 (2816 or 508) literally (case insensitive)
" matches the character " with index 3410 (2216 or 428) literally (case insensitive)
\$ matches the character $ with index 3610 (2416 or 448) literally (case insensitive)
random"
matches the characters random" literally (case insensitive)
\) matches the character ) with index 4110 (2916 or 518) literally (case insensitive)
; matches the character ; with index 5910 (3B16 or 738) literally (case insensitive)
\s
matches any whitespace character (equivalent to [\r\n\t\f\v ])
\$ matches the character $ with index 3610 (2416 or 448) literally (case insensitive)
base=base64_encode
matches the characters base=base64_encode literally (case insensitive)
\( matches the character ( with index 4010 (2816 or 508) literally (case insensitive)
\$ matches the character $ with index 3610 (2416 or 448) literally (case insensitive)
md5
matches the characters md5 literally (case insensitive)
\) matches the character ) with index 4110 (2916 or 518) literally (case insensitive)
; matches the character ; with index 5910 (3B16 or 738) literally (case insensitive)
\s
matches any whitespace character (equivalent to [\r\n\t\f\v ])
\$ matches the character $ with index 3610 (2416 or 448) literally (case insensitive)
host=md5
matches the characters host=md5 literally (case insensitive)
\( matches the character ( with index 4010 (2816 or 508) literally (case insensitive)
.
matches any character
\$ matches the character $ with index 3610 (2416 or 448) literally (case insensitive)
logon="
matches the characters logon=" literally (case insensitive)
\w
matches any word character (equivalent to [a-zA-Z0-9_])
\. matches the character . with index 4610 (2E16 or 568) literally (case insensitive)
html
matches the characters html literally (case insensitive)
\? matches the character ? with index 6310 (3F16 or 778) literally (case insensitive)
\$ matches the character $ with index 3610 (2416 or 448) literally (case insensitive)
host
matches the characters host literally (case insensitive)
\- matches the character - with index 4510 (2D16 or 558) literally (case insensitive)
\$ matches the character $ with index 3610 (2416 or 448) literally (case insensitive)
host
matches the characters host literally (case insensitive)
\- matches the character - with index 4510 (2D16 or 558) literally (case insensitive)
\$ matches the character $ with index 3610 (2416 or 448) literally (case insensitive)
host
matches the characters host literally (case insensitive)
\$ matches the character $ with index 3610 (2416 or 448) literally (case insensitive)
host
matches the characters host literally (case insensitive)
.
matches any character
header
matches the characters header literally (case insensitive)
\( matches the character ( with index 4010 (2816 or 508) literally (case insensitive)
"location:
matches the characters "location: literally (case insensitive)
\s
matches any whitespace character (equivalent to [\r\n\t\f\v ])
\$ matches the character $ with index 3610 (2416 or 448) literally (case insensitive)
logon
matches the characters logon literally (case insensitive)
Match a single character present in the list below
[[:punct:]\s]
$ asserts position at the end of the string, or before the line terminator right at the end of the string (if any)
Global pattern flags
g modifier: global. All matches (don't return after first match)
s modifier: single line. Dot matches newline characters
i modifier: insensitive. Case insensitive match (ignores case of [a-zA-Z])
Your regular expression does not match the subject string.Try launching the debugger to find out why.

Regular Expression
No Match

/
/
gsi

Test String