PHP RegEx Functions

PHP's regular expression support is provided by the PCRE extension, which is always enabled. This lesson is a complete reference to its functions, flags, error codes, and settings, with examples for the functions not covered in the previous lessons (preg_grep(), preg_filter(), and preg_quote()), plus a reusable approach to error handling.

Function Reference

The core functions are explained in preg_match, preg_replace, and preg_split.

preg_grep() — Filter an Array by Pattern

<?php
$values = ['10', 'abc', '25', '3.5', '007'];

print_r(preg_grep('/^\d+$/', $values));
print_r(preg_grep('/^\d+$/', $values, PREG_GREP_INVERT));

Output

Array
(
    [0] => 10
    [2] => 25
    [4] => 007
)
Array
(
    [1] => abc
    [3] => 3.5
)

• preg_grep() returns the elements that match, preserving their keys.
• PREG_GREP_INVERT returns the elements that do not match.

It is a shortcut for array_filter($values, fn($v) => preg_match($pattern, $v) === 1).

preg_filter() — Replace Only Where Something Matched

<?php
$items = ['item1', 'misc', 'item22'];

print_r(preg_replace('/(\d+)/', '#$1', $items));
print_r(preg_filter('/(\d+)/', '#$1', $items));

Output

Array
(
    [0] => item#1
    [1] => misc
    [2] => item#22
)
Array
(
    [0] => item#1
    [2] => item#22
)

preg_replace() returns every subject, changed or not. preg_filter() returns only the subjects in which at least one replacement happened — combining filtering and replacement in one step. For a single string subject, it returns null when nothing matched.

preg_quote() — Escape Text for Use in a Pattern

<?php
$userSearch = 'C++ (v2.0) #1';

$pattern = '/' . preg_quote($userSearch, '/') . '/i';

echo $pattern . "\n";
var_dump(preg_match($pattern, 'Learn c++ (V2.0) #1 today'));

Output

/C\+\+ \(v2\.0\) \#1/i
int(1)

preg_quote() adds a backslash before every character with special meaning in a pattern:

.  \  +  *  ?  [  ^  ]  $  (  )  {  }  =  !  <  >  |  :  -  #

plus the NUL character and, if given, the delimiter (the second argument). The # character has been escaped since PHP 7.3, which makes quoted text safe with # delimiters and in extended (x) mode. Always quote user input and other dynamic text before inserting it into a pattern.

Flags Reference

Flags can be combined with |, for example PREG_SET_ORDER | PREG_UNMATCHED_AS_NULL.

Errors

How Errors Are Reported

PCRE functions do not throw exceptions. Instead:

Error Codes

A Wrapper That Throws Exceptions

Because silent false results are easy to miss, applications often wrap PCRE calls:

<?php
function regexMatch(string $pattern, string $subject, ?array &$matches = null): bool
{
    $result = preg_match($pattern, $subject, $matches);

    if ($result === false) {
        throw new RuntimeException('Regex error: ' . preg_last_error_msg());
    }

    return $result === 1;
}

var_dump(regexMatch('/^\d+$/', '12345'));

try {
    regexMatch('/\w+/u', "abc\xFF");
} catch (RuntimeException $e) {
    echo $e->getMessage() . "\n";
}

Output

bool(true)
Regex error: Malformed UTF-8 characters, possibly incorrectly encoded

The wrapper returns a clean boolean for "matched / not matched" and turns failures into exceptions, so errors cannot be mistaken for "no match". Libraries such as composer/pcre provide complete, well-tested wrappers of this kind for all PCRE functions.

PCRE Configuration

These limits protect the server from patterns that would otherwise run for a very long time. Raising them hides the problem; rewriting an inefficient pattern solves it.

PHP also caches compiled patterns, so using the same pattern repeatedly in a loop is efficient. Building a different pattern for every iteration (for example, from user input) cannot benefit from the cache as much.

Choosing the Right Function

Practical Example: A Reusable Format Validator

<?php
const FORMATS = [
    'pincode' => '/^[1-9]\d{5}\z/',
    'mobile' => '/^[6-9]\d{9}\z/',
    'ifsc' => '/^[A-Z]{4}0[A-Z0-9]{6}\z/',
    'vehicle' => '/^[A-Z]{2}\d{2}[A-Z]{1,2}\d{4}\z/',
];

function validateFormats(array $input): array
{
    $results = [];

    foreach ($input as $field => $value) {
        if (!array_key_exists($field, FORMATS)) {
            $results[$field] = 'unknown field';
            continue;
        }

        $normalized = strtoupper(preg_replace('/\s+/', '', (string) $value) ?? '');
        $results[$field] = preg_match(FORMATS[$field], $normalized) === 1 ? 'valid' : 'invalid';
    }

    return $results;
}

$input = [
    'pincode' => '600 042',
    'mobile' => '98765',
    'ifsc' => 'sbin0001234',
    'vehicle' => 'TN 09 AB 1234',
    'aadhaar' => '1234 5678 9012',
];

foreach (validateFormats($input) as $field => $result) {
    echo str_pad($field, 8) . " $result\n";
}

Output

pincode  valid
mobile   invalid
ifsc     valid
vehicle  valid
aadhaar  unknown field

Step-by-Step Explanation

1. All patterns live in one constant array, so formats are defined in a single place and reused across forms.
2. array_key_exists() checks whether a format is defined. (isset() cannot be used on a constant expression such as FORMATS[$field]; that is a compile-time error.)
3. Input is normalized before validation: whitespace is removed with preg_replace() and letters are uppercased. Users can type 600 042 or tn 09 ab 1234 and still pass.
4. \z anchors ensure nothing follows the valid part — not even a newline.
5. Fields without a known format are reported instead of silently accepted.

An IFSC code (Indian bank branch code) has four letters for the bank, a 0, and six characters for the branch. As with all format checks, a valid format does not prove that the code actually exists.

Common Mistakes

Treating false/null as "No Match"

Effect: Pattern and encoding errors go unnoticed.

Fix: Check === false / === null, or use a throwing wrapper.

Not Escaping Dynamic Text

Effect: User input breaks the pattern or changes its meaning.

Fix: preg_quote($text, $delimiter).

Raising PCRE Limits to Fix Slow Patterns

Effect: The server spends more time on inefficient matches, which can be exploited for denial of service.

Fix: Rewrite the pattern (avoid nested quantifiers; use specific classes).

Re-implementing preg_grep() and preg_filter()

Effect: More code than necessary.

Fix: Use the built-in functions.

Best Practices

• Pick the most specific function for each task.
• Check for errors and convert them to exceptions in application code.
• Escape dynamic text with preg_quote().
• Keep reusable patterns in one place, and normalize input before validating it.
• Keep PCRE limits at their defaults and optimize patterns instead.

Official reference: https\://www.php.net/manual/en/ref.pcre.php