PHP Regex Catastrophic Backtracking — Prevent 503 Errors

<?php

// A simple pattern: does the string contain a sequence of digits?
// Delimiters are the two forward slashes. \d means 'any digit character'.
// The + means 'one or more of the preceding thing'
$pattern = '/\d+/';

$orderReference = 'Order #4821 has been dispatched.';
$productCode    = 'Widget-Blue-Large';

// preg_match returns 1 if the pattern is found, 0 if not, false on error
$orderHasNumber   = preg_match($pattern, $orderReference); // 1
$productHasNumber = preg_match($pattern, $productCode);   // 0

echo "Order reference contains digits: " . ($orderHasNumber ? 'YES' : 'NO') . PHP_EOL;
echo "Product code contains digits: "   . ($productHasNumber ? 'YES' : 'NO') . PHP_EOL;

// Using an alternative delimiter — useful when the pattern contains slashes
// This pattern matches a simple URL path segment like /products/42
$urlPattern = '#^/products/(\d+)$#';
$urlPath    = '/products/42';

// The third argument (passed by reference) captures what was matched
if (preg_match($urlPattern, $urlPath, $matches)) {
    // $matches[0] is the full match, $matches[1] is the first capture group
    echo "Product ID from URL: " . $matches[1] . PHP_EOL;
}

// The 'i' flag — case-insensitive matching
$greetingPattern = '/hello/i';
$userInput       = 'HELLO there!';

if (preg_match($greetingPattern, $userInput)) {
    echo "Found a greeting (case-insensitive match)" . PHP_EOL;
}

<?php

// --- Example 1: Numeric capture groups ---
// Pattern breaks an ISO date (2024-03-15) into year, month, day
$isoDatePattern = '/(\d{4})-(\d{2})-(\d{2})/';
$publishedDate  = 'Article published on 2024-03-15.';

if (preg_match($isoDatePattern, $publishedDate, $dateParts)) {
    // Index 0: full match '2024-03-15'
    // Index 1: year, Index 2: month, Index 3: day
    echo "Year: {$dateParts[1]}, Month: {$dateParts[2]}, Day: {$dateParts[3]}" . PHP_EOL;
}

// --- Example 2: Named capture groups (the better approach) ---
// (?P<year>\d{4}) gives the group the name 'year'
// Now the code reads like plain English
$namedDatePattern = '/(?P<year>\d{4})-(?P<month>\d{2})-(?P<day>\d{2})/';

if (preg_match($namedDatePattern, $publishedDate, $namedParts)) {
    echo "Year: {$namedParts['year']}, Month: {$namedParts['month']}, Day: {$namedParts['day']}" . PHP_EOL;
}

// --- Example 3: preg_match_all — extract every date from a longer document ---
$reportText = 'Invoice raised 2024-01-10. Payment received 2024-02-28. Closed 2024-03-15.';

// PREG_SET_ORDER makes each element of $allMatches a complete match set
$matchCount = preg_match_all($namedDatePattern, $reportText, $allMatches, PREG_SET_ORDER);

echo "Found {$matchCount} dates in the report:" . PHP_EOL;

foreach ($allMatches as $index => $match) {
    // Each $match has the same named keys as a single preg_match call
    echo "  Date " . ($index + 1) . ": {$match['year']}/{$match['month']}/{$match['day']}" . PHP_EOL;
}

// --- Example 4: Named groups for email parsing ---
$emailPattern = '/(?P<localPart>[a-zA-Z0-9._%+\-]+)@(?P<domain>[a-zA-Z0-9.\-]+\.(?P<tld>[a-zA-Z]{2,}))/';
$contactEmail = 'support@thecodeforge.io';

if (preg_match($emailPattern, $contactEmail, $emailParts)) {
    echo "Local part: {$emailParts['localPart']}" . PHP_EOL;
    echo "Domain: {$emailParts['domain']}" . PHP_EOL;
    echo "TLD: {$emailParts['tld']}" . PHP_EOL;
}

<?php

// --- Example 1: Reformat a date string using backreferences ---
// Input: MM/DD/YYYY  →  Output: YYYY-MM-DD
// The replacement uses $3, $1, $2 to reorder the captured groups
$usDatePattern     = '/(\d{2})\/(\d{2})\/(\d{4})/';
$legacyDateString  = 'Created 03/15/2024, expires 12/31/2024';

$reformattedDates = preg_replace($usDatePattern, '$3-$1-$2', $legacyDateString);
echo $reformattedDates . PHP_EOL;

// --- Example 2: Mask sensitive data (credit card numbers) ---
// Keep only the last 4 digits, replace everything else with *
// \d{4} matches exactly 4 digits. The whole pattern matches 16-digit card numbers.
$cardPattern     = '/(\d{4})(\d{4})(\d{4})(\d{4})/';
$paymentLog      = 'Charged card 4111111111111234 amount $99.99';

// Replacement keeps only group 4 (last 4 digits)
$maskedLog = preg_replace($cardPattern, '****-****-****-$4', $paymentLog);
echo $maskedLog . PHP_EOL;

// --- Example 3: preg_replace_callback — auto-link URLs in user content ---
$urlPattern  = '#(https?://[^\s<>"]+[^\s<>".,;:!?\)])#i';
$userComment = 'Check out https://thecodeforge.io and https://php.net for more info.';

$linkedComment = preg_replace_callback(
    $urlPattern,
    function (array $match): string {
        // $match[0] is the full matched URL
        // We sanitise the URL before embedding it in HTML
        $safeUrl = htmlspecialchars($match[0], ENT_QUOTES, 'UTF-8');
        return "<a href=\"{$safeUrl}\" rel=\"noopener\">{$safeUrl}</a>";
    },
    $userComment
);

echo $linkedComment . PHP_EOL;

// --- Example 4: preg_replace_callback — dynamic price formatting ---
// Multiply every price in a string by 1.2 (add 20% tax)
$pricePattern = '/\$(\d+\.\d{2})/';
$productList  = 'Widget $9.99, Gadget $24.99, Thingamajig $4.50';

$pricesWithTax = preg_replace_callback(
    $pricePattern,
    function (array $match): string {
        $priceWithTax = round((float)$match[1] * 1.20, 2);
        // number_format ensures we always get 2 decimal places
        return '$' . number_format($priceWithTax, 2);
    },
    $productList
);

echo $pricesWithTax . PHP_EOL;

<?php

/**
 * Validates an email address using a practical (not RFC-perfect) pattern.
 * Good enough for form validation; catches obvious typos and format errors.
 */
function isValidEmail(string $email): bool {
    // [a-zA-Z0-9._%+\-]+ matches the local part (before the @)
    // [a-zA-Z0-9.\-]+ matches the domain name
    // [a-zA-Z]{2,} matches the TLD — at least 2 letters
    $emailPattern = '/^[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}$/';
    return (bool) preg_match($emailPattern, $email);
}

/**
 * Validates a UK mobile number.
 * Accepts formats: 07911 123456, +447911123456, 07911123456
 */
function isValidUKMobile(string $phoneNumber): bool {
    // Strip all spaces first so the pattern doesn't need to account for them
    $normalised    = preg_replace('/\s+/', '', $phoneNumber);
    // Matches 07xxxxxxxxx or +447xxxxxxxxx (11 or 13 digits)
    $mobilePattern = '/^(\+44|0)7\d{9}$/';
    return (bool) preg_match($mobilePattern, $normalised);
}

/**
 * Validates password strength using lookaheads.
 * Rules: min 8 chars, at least 1 uppercase, 1 lowercase, 1 digit, 1 special char.
 */
function isStrongPassword(string $password): bool {
    // Each (?=...) is a lookahead — it checks ahead without moving the cursor
    // (?=.*[A-Z])    — must contain at least one uppercase letter somewhere
    // (?=.*[a-z])    — must contain at least one lowercase letter somewhere
    // (?=.*\d)       — must contain at least one digit somewhere
    // (?=.*[^a-zA-Z\d]) — must contain at least one non-alphanumeric char
    // .{8,}          — the actual string must be at least 8 characters long
    $passwordPattern = '/^(?=.*[A-Z])(?=.*[a-z])(?=.*\d)(?=.*[^a-zA-Z\d]).{8,}$/';
    return (bool) preg_match($passwordPattern, $password);
}

/**
 * Validates a UK postcode (e.g. SW1A 1AA, EC1A 1BB, W1A 0AX)
 */
function isValidUKPostcode(string $postcode): bool {
    $normalised      = strtoupper(trim($postcode));
    $postcodePattern = '/^[A-Z]{1,2}[0-9][0-9A-Z]?\s?[0-9][ABD-HJLNP-UW-Z]{2}$/';
    return (bool) preg_match($postcodePattern, $normalised);
}

// --- Test all validators ---
$testEmails = ['user@example.com', 'bad@', 'also.bad', 'good+tag@domain.co.uk'];
echo "=== Email Validation ===".PHP_EOL;
foreach ($testEmails as $email) {
    echo "  {$email}: " . (isValidEmail($email) ? 'VALID' : 'INVALID') . PHP_EOL;
}

$testPhones = ['07911 123456', '+447911123456', '0207 123 4567', '07911123456'];
echo PHP_EOL."=== UK Mobile Validation ===".PHP_EOL;
foreach ($testPhones as $phone) {
    echo "  {$phone}: " . (isValidUKMobile($phone) ? 'VALID' : 'INVALID') . PHP_EOL;
}

$testPasswords = ['weak', 'AllLetters1', 'N0Special!', 'Str0ng@Pass!'];
echo PHP_EOL."=== Password Strength Validation ===".PHP_EOL;
foreach ($testPasswords as $password) {
    echo "  {$password}: " . (isStrongPassword($password) ? 'STRONG' : 'WEAK') . PHP_EOL;
}

$testPostcodes = ['SW1A 1AA', 'ec1a1bb', 'W1A 0AX', 'INVALID', 'BS1 4DJ'];
echo PHP_EOL."=== UK Postcode Validation ===".PHP_EOL;
foreach ($testPostcodes as $postcode) {
    echo "  {$postcode}: " . (isValidUKPostcode($postcode) ? 'VALID' : 'INVALID') . PHP_EOL;
}

<?php

// --- The problematic pattern: nested greedy quantifiers ---
$badPattern = '/(.*)+(.)+(.*)+/';
$shortString = 'short';
$longString  = str_repeat('a', 10000);

// This will trigger backtrack limit on long input
$result = preg_match($badPattern, $longString);
if ($result === false) {
    $error = preg_last_error();
    echo "Backtrack error code: $error" . PHP_EOL;
    // $error == 2 means PCRE_BACKTRACK_LIMIT_ERROR
}

// --- The fix: possessive quantifiers and atomic groups ---
// Possessive quantifier ++ gives up backtracking as soon as it matches
$goodPattern = '/[^\n]*+foo[^\n]*+/';
$text = 'first line foo something' . "\n" . 'second line bar';

if (preg_match($goodPattern, $text, $match)) {
    echo "Match with possessive: " . $match[0] . PHP_EOL;
}

// --- Atomic groups: (?>...) prevents backtracking inside ---
$atomicPattern = '/(?>".*?")[^\\"]*/';
$jsonSample    = '"key" : "value"';

if (preg_match($atomicPattern, $jsonSample)) {
    echo "Atomic group matched" . PHP_EOL;
}

// --- Best practice: set limits in code for critical paths ---
$oldLimit = ini_get('pcre.backtrack_limit');
ini_set('pcre.backtrack_limit', 500000);

$pattern = '/^[a-zA-Z]+$/';  // simple pattern, safe
if (preg_match($pattern, 'HelloWorld') === 1) {
    echo "Pattern works with custom limit" . PHP_EOL;
}

ini_set('pcre.backtrack_limit', $oldLimit);