Anyone compiling regex strings in PHP from user input should take care to use preg_quote(): http://php.net/manual/en/function.preg-quote.php Otherwise, you're in risky business trusting what a user could send you.