Regex Match Any Character: The Dot, Newlines and Dotall

What the dot really matches

By default, . matches any single character except a line terminator. On a single-line string that is indistinguishable from "any character"; on multi-line input it means your pattern stops at the first newline.

This is why a pattern like <div>.*</div> matches a one-line snippet and returns nothing on formatted HTML. The content contains newlines the dot refuses to cross.

Matching newlines too

The dotall flag makes . match line terminators as well: /s in JavaScript, PHP and Java (Pattern.DOTALL), re.DOTALL in Python, RegexOptions.Singleline in C#. Where the flag is unavailable, a character class that covers everything does the same job:

/<div>.*<\/div>/s        // dotall: the dot crosses newlines
/<div>[\s\S]*<\/div>/    // same result, no flag needed
/"[^"]*"/                // quoted string — cannot cross the quote
/^(?!admin).*$/          // any line that does not start with admin

[\s\S] matches any whitespace or any non-whitespace, which is every character. [\d\D] and [\w\W] work identically.

Do not confuse dotall with multiline. Multiline (/m) changes what ^ and $ mean; dotall (/s) changes what . means. They are independent and often used together.

Matching anything except something

A negated character class is the precise tool: [^"]* matches everything up to the next quote, [^,]+ matches a CSV field, [^>]* matches inside a tag.

This is almost always better than .*? because it cannot cross the delimiter at all, which makes the intent explicit and the match faster. Prefer "[^"]*" over ".*?" for quoted strings.

To exclude a whole word rather than a set of characters, use a negative lookahead: ^(?!admin).*$ matches any line that does not start with admin.

The cost of .* and .+

Greedy .* consumes to the end of the input then backtracks. On long strings, combined with alternation or nested quantifiers, that backtracking can go exponential — the classic ReDoS failure that pins a CPU core.

Make it lazy with .*? when you want the shortest match, and prefer a negated class when you know the delimiter. If a pattern must handle untrusted input, test it against a long adversarial string before shipping.

And remember to escape the dot when you mean a literal period: \. in a pattern, or put it in a class as [.] where it needs no escape.