Regular expression does not match when using Regex.Escape

Question

For the code below, I want:

strPattern.IsMatch("@!*()[]{}:?.,^%#$~`:;'_-@!*()[]{}/\\")

to be true, but almost everything I put in the regex is returning false

Essentially I want:

• strip the html first (no html should be allowed)
• All the characters above, should be a match (these are my allowed characters)

• Everything else should fail

  string escapedPattern1 = Regex.Escape("@!*()[]{}");
  string escapedPattern2 = Regex.Escape(":?.,^%#$~`:;'_-");
  string escapedPattern3 = Regex.Escape("@!*()[]{}");
  string escapedPattern4 = Regex.Escape(@"/\\");
  string stripped = securityHelper.StripHtml(value);
  string totalPattern = "0-9A-Za-z&" + escapedPattern1 + escapedPattern2 + escapedPattern3 + escapedPattern4;
  Regex strPattern = new Regex("^[" + totalPattern + "]*$");
  

Answer 1

Regex.Escape does not handle "-" or "]" and is generally unsuited for the contents of a character class. In this case the resulting regular expression will be wrong¹ as they will both have their special meaning.

I would just simplify it and write it manually. I've also removed the redundant characters and fixed other various issues.

 Regex p = new Regex(@"^[]0-9A-Za-z&[@!*(){}:?.,^%#$~`;'_/\\-]*$");
 p.IsMatch("@!*()[]{}:?.,^%#$~`:;'_-@!*()[]{}/\\")  // -> true
 p.IsMatch("Hello`World!")                          // -> true
 p.IsMatch("@<")                                    // -> false

Notes:

1. To use a ] in a character class, write it as []..] or (verbatim) [..\]..].
2. To use a - in a character class, write it as [..-] or (verbatim) [..\-..].

Also, "stripping the HTML" is unrelated.

---

¹ The resulting regular expression in the original post is string is

^[0-9A-Za-z&@!\*\(\)\[]\{}:\?\.,\^%\#\$~`:;'_-@!\*\(\)\[]\{}/\\\\]*$

and the error is easy to spot once substituting in a dummy placeholder.

^[characterclass]\{}:\?\.,\^%\#\$~`:;'_-@!\*\(\)\[]\{}/\\\\]*$