This site I'm working on relies heavily on user input through forms, and all that data needs to be checked before being sent a database. I knew PHP3's regular expression functions should solve my problem, but I didn't know how to form the regular expressions in the first place. What I needed were some sample strings--obviously the first places I looked were the PHP3 manual and the POSIX 1002.3 specification, but they don't help much in the way of exemplifying. Adding to that, I had a really hard time finding good literature on the Web about the subject. I eventually got to know how to do it, mostly through experimenting, and seeing there wasn't much to it, I decided to write down this straight-out introduction to the syntax and a step-by-step on building regular expressions to validate money and e-mail address strings. I just hope it manages to clear the fog around the subject for all you fellow programmers.

First of all, let's take a look at two special symbols: '^' and '$'. What they do is indicate the start and the end of a string, respectively, like this:

• "^The": matches any string that starts with "The";
• "of despair$": matches a string that ends in the substring "of despair";
• "^abc$": a string that starts and ends with "abc" -- that could only be "abc" itself!
• "notice": a string that has the text "notice" in it.

You can see that if you don't use either of the two characters we mentioned, as in the last example, you're saying that the pattern may occur anywhere inside the string -- you're not "hooking" it to any of the edges.

There are also the symbols '*', '+', and '?', which denote the number of times a character or a sequence of characters may occur. What they mean is: "zero or more", "one or more", and "zero or one." Here are some examples:

• "ab*": matches a string that has an a followed by zero or more b's ("a", "ab", "abbb", etc.);
• "ab+": same, but there's at least one b ("ab", "abbb", etc.);
• "ab?": there might be a b or not;
• "a?b+$": a possible a followed by one or more b's ending a string.

You can also use bounds, which come inside braces and indicate ranges in the number of occurences:

• "ab{2}": matches a string that has an a followed by exactly two b's ("abb");
• "ab{2,}": there are at least two b's ("abb", "abbbb", etc.);
• "ab{3,5}": from three to five b's ("abbb", "abbbb", or "abbbbb").

Note that you must always specify the first number of a range (i.e, "{0,2}", not "{,2}"). Also, as you might have noticed, the symbols '*', '+', and '?' have the same effect as using the bounds "{0,}", "{1,}", and "{0,1}", respectively.

Now, to quantify a sequence of characters, put them inside parentheses:

• "a(bc)*": matches a string that has an a followed by zero or more copies of the sequence "bc";
• "a(bc){1,5}": one through five copies of "bc."

There's also the '|' symbol, which works as an OR operator:

• "hi|hello": matches a string that has either "hi" or "hello" in it;
• "(b|cd)ef": a string that has either "bef" or "cdef";
• "(a|b)*c": a string that has a sequence of alternating a's and b's ending in a c;

A period ('.') stands for any single character:

• "a.[0-9]": matches a string that has an a followed by one character and a digit;
• "^.{3}$": a string with exactly 3 characters.

Bracket expressions specify which characters are allowed in a single position of a string:

• "[ab]": matches a string that has either an a or a b (that's the same as "a|b");
• "[a-d]": a string that has lowercase letters 'a' through 'd' (that's equal to "a|b|c|d" and even "[abcd]");
• "^[a-zA-Z]": a string that starts with a letter;
• "[0-9]%": a string that has a single digit before a percent sign;
• ",[a-zA-Z0-9]$": a string that ends in a comma followed by an alphanumeric character.

You can also list which characters you DON'T want -- just use a '^' as the first symbol in a bracket expression (i.e., "%[^a-zA-Z]%" matches a string with a character that is not a letter between two percent signs).

In order to be taken literally, you must escape the characters "^.[$()|*+?{\" with a backslash ('\'), as they have special meaning. On top of that, you must escape the backslash character itself in PHP3 strings, so, for instance, the regular expression "(\$|¥)[0-9]+" would have the function call: ereg("(\\$|¥)[0-9]+", $str) (what string does that validate?)

Just don't forget that bracket expressions are an exception to that rule--inside them, all special characters, including the backslash ('\'), lose their special powers (i.e., "[*\+?{}.]" matches exactly any of the characters inside the brackets). And, as the regex man pages tell us: "To include a literal ']' in the list, make it the first character (following a possible '^'). To include a literal '-', make it the first or last character, or the second endpoint of a range."

For completeness, I should mention that there are also collating sequences, character classes, and equivalence classes. I won't be getting into details on those, as they won't be necessary for what we'll need further down this article. You should refer to the regex man pages for more information.