Most of the regular expression engines use ``++backtracking++`` to try all possible execution paths of the regular expression when evaluating an input, in some cases it can cause performance issues, called ``++catastrophic backtracking++`` situations. In the worst case, the complexity of the regular expression is exponential in the size of the input, this means that a small carefully-crafted input (like 20 chars) can trigger ``++catastrophic backtracking++`` and cause a denial of service of the application. Super-linear regex complexity can lead to the same impact too with, in this case, a large carefully-crafted input (thousands chars).


PHP prevents Denial of Service attacks with https://www.php.net/manual/en/pcre.configuration.php[configuration settings] set by default to safe values. lf the ``++pcre.backtrack_limit++`` or ``++pcre.recursion_limit++`` settings are set to higher values than the default values, make sure that it is not too large numbers that will expose the application to Denial of Service in the event of incorrect or malicious regex evaluation. However, despite this mitigation it is recommended to validate/escape user-controlled inputs.


It is not recommended to construct a regular expression pattern from a user-controlled input, if no other choice, sanitize the input to remove/annihilate regex metacharacters.

== Noncompliant Code Example

----
$regex = $_GET["regex"];
$input = $_GET["input"];

preg_grep($regex, $input); // Noncompliant
----

== Compliant Solution

----
$regex = $_GET["regex"];
$input = $_GET["input"];

preg_grep(preg_quote($regex), $input); // Compliant
----

include::../see.adoc[]

ifdef::env-github,rspecator-view[]
'''
== Comments And Links
(visible only on this page)

include::../comments-and-links.adoc[]
endif::env-github,rspecator-view[]
