Storing Regex as strings in database and then retrieving for use in Javascript and PHP

Question

Main Question: Should escaped backslashes also be stored in the database for Javascript and how well that would play with PHP's regex engine?

Details

I have a number of regex patterns which can be used to classify strings into various categories. An example is as below:

(^A)|(\(A)

This can recognize for example an "A" in the start of the string or if it is immediately after an opening bracket ( but not if it is anywhere else in the string.

• DBC(ABC)AA

• ABC(DBC)AA

My project uses these regex patterns in two languages PHP and Javascript.

I want to store these patterns in a MySQL database and since there is no datatype for regex, I thought I could store it as VARCHAR or TEXT.

The issue arises if I directly use strings in Javascript, the \( is counted only as ( as the \ backslash is used as an escape character. if this is used to create new RegExp it gives an error:

Uncaught SyntaxError: unterminated parenthetical

For example:

let regexstring = "(^A)|(\(A)";

console.log(regexstring); // outputs => "(^A)|((A)"

let regex = new RegExp(regexstring); // Gives Uncaught SyntaxError: unterminated parenthetical

Based on this answer in StackOverflow, the solution is to escape the backslashes like:

let regexstring = "(^A)|(\\(A)";

console.log(regexstring); // Outputs => "(^A)|(\\(A)"

regex = new RegExp(regexstring);

The question is therefore, should escaped backslashes also be stored in the database and how well that would play with PHP's regex engine?

Answer 1

I would store the raw regular expression.

The additional escape character is not actually part of the regex. It's there for JS to process the string correctly, because \ has a special meaning. You need to specify it when writing the string as "hardcoded" text. In fact, it would also be needed in the PHP side, if you were to use the same assignment technique in PHP, you would write it with the escape backslash:

$regexstring = "(^A)|(\\(A)";

You could also get rid of it if you changed the way you initialize regexstring in your JS:

<?
...
$regexstring = $results[0]["regexstring"];
?>

let regexstring = decodeURIComponent("<?=rawurlencode($regexstring);?>");
console.log(regexstring);

Another option is to just add the escaping backslashes in the PHP side:

<?
...
$regexstring = $results[0]["regexstring"];
$escapedRegexstring = str_replace('\', '\\', $regexstring);
?>

let regexstring = "<?=$escapedRegexstring;?>";

However, regardless of escaping, you should note that there are other differences in syntax between PHP's regex engine and the one used by JS, so you may end up having to maintain two copies anyway.

Lastly, if these regex expressions are meant to be provided by users, then keep in mind that outputting them as-is into JS code is very dangerous as it can easily cause an XSS vulnerability. The first method, of passing it through rawurlencode (in the PHP side) and decodeURIComponent (in the JS side) - should eliminate this risk.