Regex Match Brackets: Escaping Metacharacters Correctly

Outside a character class

These twelve are special and need a backslash to match literally: . ^ $ * + ? ( ) [ ] { } | — and \ itself:

\[.*?\]        # matches [anything] including the brackets
\(\d+\)        # matches (123)
\{.*?\}        # matches {json-ish}
\\             # matches one literal backslash
:              # colon is NOT special — no escape needed

The colon, comma, hyphen (outside a class), slash and quotes are not metacharacters. Escaping them is harmless but adds noise, and \: is an error in some strict engines.

Inside a character class

Almost nothing is special inside [...]. Only ], \, ^ (first position) and - (between two characters) need care:

[(){}[\]]      # all bracket types — only ] needs escaping
[.*+?]         # literal dot, star, plus, question mark
[a\-z]         # literal hyphen, not a range
[-az]          # hyphen first is also literal
[^]]           # anything except a closing bracket

Placing - first or last in the class avoids escaping it entirely, which is the conventional style.

The backslash multiplier

To match one literal backslash the regex is \\. In a language without raw strings, the string literal doubles it again — so Java and C# without @ need "\\\\" for a single backslash.

This is why raw strings matter: Python r"\\", C# @"\\", and JavaScript regex literals /\\/ all keep the pattern readable. A Windows path pattern written without them becomes unmaintainable quickly.

Escaping dynamically

Never build a pattern by concatenating user input — a stray ( breaks compilation and a crafted input can create a catastrophic pattern. Use the escape helper:

re.escape(user_input)              # Python
preg_quote($input, '/')            # PHP
Pattern.quote(input)               # Java
Regex.Escape(input)                # C#
// JavaScript has none built in:
input.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')