{"id":1519,"date":"2021-03-20T20:13:42","date_gmt":"2021-03-20T20:13:42","guid":{"rendered":"https:\/\/dft.wiki\/?p=1519"},"modified":"2021-11-26T22:55:42","modified_gmt":"2021-11-26T22:55:42","slug":"regular-expressions-regex-cheat-sheet","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=1519","title":{"rendered":"Regular Expressions (RegEx) Cheat Sheet"},"content":{"rendered":"<p>Knowing how to write RegEx is crucial for creating or customizing modules or rules for Fail2Ban, Snort, etc.<\/p>\n<p>RegEx basically searches the text comparing with a syntax that matches.<\/p>\n<p>A great online tool for testing is the expressions in realtime is RegExr [<a href=\"https:\/\/regexr.com\/\">Link<\/a>].<\/p>\n<p><strong>Basics<\/strong><\/p>\n<ul>\n<li><strong><span style=\"color: #000000;\"><span style=\"color: #ff0000;\">\/<\/span>abc<span style=\"color: #ff0000;\">\/<\/span><\/span><\/strong>\n<ul>\n<li>searches for <strong><span style=\"color: #000000;\">abc<\/span><\/strong> in the text and stop when finding it.<\/li>\n<\/ul>\n<\/li>\n<li><strong><span style=\"color: #000000;\"><span style=\"color: #ff0000;\">\/<\/span>abc<span style=\"color: #ff0000;\">\/g<\/span><\/span><\/strong>\n<ul>\n<li>searches for <strong><span style=\"color: #000000;\">abc<\/span><\/strong> in the text, and <strong>\/g<\/strong> will keep searching for through the text for more matches.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #ff0000;\"><strong><span style=\"color: #000000;\">\/abc\/g<\/span>i<\/strong><\/span>\n<ul>\n<li>informs the search that it is case <strong><span style=\"color: #000000;\">i<\/span><\/strong>nsensitive.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/a<span style=\"color: #ff0000;\">+<\/span>\/g<\/strong><\/span>\n<ul>\n<li>searches for one or more consecutive <strong><span style=\"color: #000000;\">a<\/span><\/strong>.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/a<span style=\"color: #ff0000;\">b?<\/span>\/g<\/strong><\/span>\n<ul>\n<li>searches for <strong>a<\/strong> and optionally <strong>b<\/strong>. Anything before <strong>? is optional<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/a<span style=\"color: #ff0000;\">b*<\/span>\/g<\/strong><\/span>\n<ul>\n<li><strong>*<\/strong> means optionally any number of the <strong>b&#8217;s<\/strong>. From zero to many <strong><span style=\"color: #000000;\">b<\/span>&#8216;s<\/strong> after <strong><span style=\"color: #000000;\">a<\/span><\/strong>.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/<span style=\"color: #ff0000;\">.b<\/span>\/g<\/strong><\/span>\n<ul>\n<li><strong>.<\/strong> is a wildcard and will search for any character plus <strong>b<\/strong>. It does not match with the period itself.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/<span style=\"color: #ff0000;\">\\.<\/span>\/g<\/strong><\/span>\n<ul>\n<li>searches for the <strong>period itself<\/strong>. Same for ()[]{} etc, just use \\(\\)\\[\\]\\{\\} before to do not interpret but use the character itself.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/<span style=\"color: #ff0000;\">\\.$<\/span>\/g<\/strong><\/span>\n<ul>\n<li>searches for the <strong>period<\/strong> at the <strong>end of the text<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong><span style=\"color: #000000;\">\/\\.$\/g<\/span><span style=\"color: #ff0000;\">m<\/span><\/strong><\/span>\n<ul>\n<li>searches for the <strong>period<\/strong> at the <strong>end of each line<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/<span style=\"color: #ff0000;\">^abc<\/span>\/g<\/strong><\/span>\n<ul>\n<li>searches for <strong>abc<\/strong> at the <strong>beginning of the text<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/<span style=\"color: #000000;\">^abc<\/span>\/g<span style=\"color: #ff0000;\">m<\/span><\/strong><\/span>\n<ul>\n<li>searches for <strong>abc<\/strong> at the <strong>beginning of each line<\/strong> in a multiline text.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/<span style=\"color: #ff0000;\">\\w<\/span>\/g<\/strong><\/span>\n<ul>\n<li>matches with any <strong>word<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/<span style=\"color: #ff0000;\">\\W<\/span>\/g<\/strong><\/span>\n<ul>\n<li>matches with anything that is <strong>not a word<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/<span style=\"color: #ff0000;\">\\s<\/span>\/g<\/strong><\/span>\n<ul>\n<li>matches with any <strong>white space<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/<span style=\"color: #ff0000;\">\\S<\/span>\/g<\/strong><\/span>\n<ul>\n<li>matches with anything that is <strong>not white space<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/<span style=\"color: #ff0000;\">\\w{5}<\/span>\/g<\/strong><\/span>\n<ul>\n<li>matches with any <strong>5 characters<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/<span style=\"color: #ff0000;\"><span style=\"color: #000000;\">\\w<\/span>{5,}<\/span>\/g<\/strong><\/span>\n<ul>\n<li>matches with any <strong>5 characters or more<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/<span style=\"color: #ff0000;\"><span style=\"color: #000000;\">\\w<\/span>{5,8}<\/span>\/g<\/strong><\/span>\n<ul>\n<li>matches with any <strong>5 to 8 characters<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<li><strong>\/<span style=\"color: #ff0000;\">\\d<\/span>\/g<\/strong>\n<ul>\n<li><strong>\\d<\/strong> means digits (<strong>numbers<\/strong>).<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/<span style=\"color: #ff0000;\">[a<b>\u00e1<\/b><b>\u00e0<\/b>\u00e3\u0103\u00e2]<span style=\"color: #000000;\">bc<\/span><\/span>\/g<\/strong><\/span>\n<ul>\n<li>matches with any of the <strong>list of characters<\/strong> plus <strong>bc<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/<span style=\"color: #ff0000;\">[a-zA-Z0-9]<\/span>\/g<\/strong><\/span>\n<ul>\n<li><strong>list<\/strong> characters using <strong>ranges<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/<span style=\"color: #ff0000;\">[^0-9]<\/span>\/g<\/strong><\/span>\n<ul>\n<li>searches for characters <strong>NOT in the list<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/<span style=\"color: #ff0000;\">(abc|xyz)<\/span>\/g<\/strong><\/span>\n<ul>\n<li><strong>group<\/strong> of possible characters with the operator <strong>|<\/strong> that means <strong>or<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/<span style=\"color: #ff0000;\">(x|y|z){2,3}<\/span>\/g<\/strong><\/span>\n<ul>\n<li>requires two or three consecutive (<strong>length<\/strong>) characters of the <strong>group<\/strong> to match.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/<span style=\"color: #ff0000;\">(?&lt;=acb).<\/span>\/g<\/strong><\/span>\n<ul>\n<li>the <em>positive look behind<\/em> searches for <strong>anything that is preceded by<\/strong> abc, but not select the abc itself.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/<span style=\"color: #000000;\">(?&lt;<span style=\"color: #ff0000;\">!<\/span>acb).<\/span>\/g<\/strong><\/span>\n<ul>\n<li>the <em>negative look behind<\/em> searches for <strong>anything that is NOT preceded by<\/strong> abc.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/<span style=\"color: #ff0000;\">.(?=acb)<\/span>\/g<\/strong><\/span>\n<ul>\n<li>the <em>positive look ahead<\/em> searches for <strong>anything that is succeeded by<\/strong> abc.<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"color: #000000;\"><strong>\/.<span style=\"color: #000000;\">(?<span style=\"color: #ff0000;\">!<\/span>acb)<\/span>\/g<\/strong><\/span>\n<ul>\n<li>the <em>negative look ahead<\/em> searches for <strong>anything that is NOT succeeded by<\/strong> abc.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>Expressions<\/strong><\/p>\n<ul>\n<li><strong>\/(<span style=\"color: #ff0000;\">?&lt;name1&gt;<\/span>abc)(<span style=\"color: #ff0000;\">?&lt;name2&gt;<\/span>xyz)(<span style=\"color: #ff0000;\">?:<span style=\"color: #000000;\">mnt<\/span><\/span>)\/<\/strong>\n<ul>\n<li>gives <strong>names for each piece of the match<\/strong>, abc will be name1, xyz will be name2, and nmt will not be named. The future usage can be <strong>$name2$name1 to invert the order<\/strong> of the groups in a <em>find and replace<\/em>.<\/li>\n<\/ul>\n<\/li>\n<li><strong>\/<span style=\"color: #ff0000;\">(\\+?[1-9]{1,3}[ -]?)?\\(?\\d{3}\\)?[ -]?\\d{3}[ -]?\\d{4}<\/span>\/<\/strong>\n<ul>\n<li>will validate any telephone number like the following:\n<ul>\n<li>1234567890<br \/>\n123-456-7890<br \/>\n123 456 7890<br \/>\n(123) 456 7890<br \/>\n1 (123) 456 7890<br \/>\n+1(123)4567890<br \/>\n+55 1234567890<br \/>\n+551234567890<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li><strong>\/<span style=\"color: #ff0000;\">[a-z0-9-._%+]{1,50}@[a-z0-9-._]{1,50}\\.[a-z]{2,}<\/span>\/<\/strong>\n<ul>\n<li>validates e-mails like the following.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<hr \/>\n<p><strong>SOURCES<\/strong><\/p>\n<p>Excellent deep dive into Regular Expression [<a href=\"https:\/\/www.grymoire.com\/Unix\/Regular.html\">Link<\/a>].<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Knowing how to write RegEx is crucial for creating or customizing modules or rules for [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-1519","post","type-post","status-publish","format-standard","hentry","category-general"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/1519","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1519"}],"version-history":[{"count":9,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/1519\/revisions"}],"predecessor-version":[{"id":2565,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/1519\/revisions\/2565"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1519"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1519"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1519"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}