Tell me more ×  I want to add regular expression search
capability to my public web page. Other than HTML encoding the
output, do I need to do anything to guard against malicious user
input?  Google searches are swamped by people solving the
converse problem-- using regular expressions to detect malicious
input--which I'm not interested in. In my scenario, the user
input is a regular expression.  I'll be using the Regex library
in .NET (C#).  share|improve this question This could depend on
what language and/or regex library you use. –  aschepler Jan 2
'11 at 17:21 add comment  6 Answers  up vote 182 down vote
accepted  Denial‐of‐Service Concerns  The most common concern
with regexes is a denial‐of‐service attack through pathological
patterns that go exponential — or even super‐exponential! — and
so appear to take forever to solve. These may only show up on
particular input data, but one can generally create one wherein
this doesn’t matter.  Which ones these are will depend somewhat
on how smart the regex com