Regex escaper
Runs in your browser · nothing is uploaded
Escapes every character that means something to the regular-expression engine, so a literal string — a price, a file path, a URL; can be dropped into a pattern and match itself rather than being read as syntax.
How to escape text for a regex
Twelve characters carry meaning inside a pattern and have to be escaped to match literally: . * + ? ^ $ { } ( ) | [ ] \. A forward slash and a hyphen are added here too; the slash because a pattern written between slashes needs it, the hyphen because inside a character class an unescaped one means a range.
The reason this matters beyond convenience is injection. Building a pattern by concatenating user input is the regex equivalent of building SQL by concatenation: a search box that puts what someone typed straight into a new RegExp can be handed (a+)+$ and made to hang the process. Escaping first removes the syntax and leaves the text. JavaScript has no built-in for this; RegExp.escape was proposed and only recently reached browsers — which is why almost every codebase has its own copy of the same one-line function.
Questions
The twelve metacharacters . * + ? ^ $ { } ( ) | [ ] and the backslash, plus the forward slash and hyphen for safety inside slashes and character classes.
It was standardised only recently and is not in every browser or runtime yet, which is why most codebases still carry their own.
Yes, partly. Concatenating user input into a pattern lets someone supply syntax, including a pattern that hangs the process.
Only by adding backslashes. The escaped pattern matches the original exactly.
No.