What are the differences between regex in JavaScript, Python, Go, and PCRE?+
JavaScript and Python use backtracking engines with similar core syntax (Python is closer to PCRE, supports verbose /x mode, Python-style named groups). Go uses RE2, a linear-time engine that drops backreferences, lookarounds, and atomic groups in exchange for guaranteed performance on adversarial input. PCRE is the most expressive, recursion, conditionals, atomic groups, possessive quantifiers, and powers Perl, PHP, nginx, and most Unix tools. The biggest practical surprises: Go has no lookbehind, JavaScript has no /x flag, and Go uses (?P<name>...) for named groups while modern JS/PCRE use (?<name>...).
What is catastrophic backtracking and how do I avoid it?+
Catastrophic backtracking is when a regex engine explores an exponential number of possible matches before failing, turning a 50ms operation into a 30-second CPU spike. It happens when nested quantifiers can match the same input multiple ways: (a+)+, (a|a)*, (a|aa)+ are classic offenders. Fixes: (1) use atomic groups (?>a+)+ or possessive quantifiers a++ in PCRE; (2) anchor your pattern to prevent overlap with .*?; (3) be specific instead of generic, [^"]+ instead of .+? when matching inside quotes; (4) for untrusted input, use Go (RE2) or a regex linter like RegexBuddy / SafeRegex. Modern V8 has limited safety but still allows catastrophic patterns.
What is the difference between greedy and lazy quantifiers?+
Greedy quantifiers (* + ? {n,m}) match as much as possible. Lazy quantifiers (*? +? ?? {n,m}?) match as little as possible. Classic example: <.+> on '<a>b</a>' matches the entire string greedily; <.+?> matches just '<a>'. Lazy quantifiers still backtrack, they're not 'safe' against catastrophic backtracking. For true non-backtracking matching, use possessive quantifiers (PCRE: *+ ++) or atomic groups ((?>...)). In Go's RE2, the distinction is purely cosmetic because the engine never backtracks anyway.
How do I match Unicode characters in a regex?+
In JavaScript, add the /u flag and use \p{Letter}, \p{Number}, etc., Unicode property escapes. /[a-z]/i won't match 'é'; /\p{Letter}/u will. In Python 3, Unicode is on by default, \w matches accented letters automatically. To restrict to ASCII, pass re.ASCII. In Go (RE2), Unicode property support is limited to script names, \p{Han} works, \p{Letter} does not. In PCRE, use /u flag and \p{...} just like JavaScript. The pitfall everyone hits: writing [a-zA-Z] when you should write \p{Letter}, your regex silently rejects every non-English name in your input.
How do I write a regex that's safe for user input?+
Two layers. First, the pattern: prefer specific character classes ([^,]+ over .+), avoid nested quantifiers, use atomic groups or possessive quantifiers when available, anchor with ^ and $ so the engine doesn't scan the whole string. Second, the engine: untrusted patterns should run in RE2 (Go), Rust's regex crate, or with an explicit timeout (Java's Pattern.matcher().region() with a timeout watchdog). Never compile user-supplied regex against V8 or Python's re without timeouts. For static patterns against user-supplied input, audit with the SafeRegex / rxxr2 linter, or just sanitize input length to a sane maximum before matching.