This is PCRE specific, each match is one of these entities [<>"&']
that do not exist inside of any tag or invisible content like scripts.
It bypasses all tags using the (*SKIP)(*FAIL)
verb combination.
Change the class to ["]
if your just wanting the double quote.
(?:<(?:(?:(?:(script|style|object|embed|applet|noframes|noscript|noembed)(?:\s+(?>"[\S\s]*?"|'[\S\s]*?'|(?:(?!/>)[^>])?)+)?\s*>)[\S\s]*?</\1\s*(?=>))|(?:/?[\w:]+\s*/?)|(?:[\w:]+\s+(?:"[\S\s]*?"|'[\S\s]*?'|[^>]?)+\s*/?)|\?[\S\s]*?\?|(?:!(?:(?:DOCTYPE[\S\s]*?)|(?:\[CDATA\[[\S\s]*?\]\])|(?:--[\S\s]*?--)|(?:ATTLIST[\S\s]*?)|(?:ENTITY[\S\s]*?)|(?:ELEMENT[\S\s]*?))))>(*SKIP)(*FAIL)|[<>"&'])
see example here -> https://regex101.com/r/OPsM1K/1
On non-PCRE type engines, the regex is altered by deleting the verbs, and capturing (matching) both
tags and entities in different groups.
This is a passive way of bypassing tags and at the same time matching entities.
It requires a search or a replace with a callback capability to determine which group
matched and act accordingly.
(this regex is not shown, if needed I'll include it).