String methods are excellent when the question is simple: does a label start with a prefix, or does text contain a known substring? A regular expression is useful when the question describes a structured pattern, such as a product code made from a letter prefix followed by a fixed number of digits. Its compact notation can express that structure, but a pattern also needs a clear matching scope and sensible resource limits.
The examples use .NET 8 and C# 12. You will validate a small internal code format, extract a named part, and write a worked extractor for log lines. The goal is a pattern you can explain and test, rather than a mysterious expression copied from an unrelated problem.
Read the pattern as a grammar
A character class such as [A-Z] matches one character from the specified range. A quantifier describes repetition: {3} means exactly three occurrences, while + means one or more. Parentheses group a subpattern. A named group such as (?<number>[0-9]{4}) both matches the digits and gives the captured text a useful name.
The pattern's meaning comes from the combination of these pieces. For an internal code like AB-1234, two uppercase ASCII letters, a literal hyphen, and four ASCII digits form a precise grammar. [0-9] deliberately means ASCII digits. In .NET, \d can match decimal digits from Unicode categories, which may be broader than a file format intends. Choosing the character set is part of the contract, not a minor cosmetic preference.
Validation needs whole-input boundaries
Regex.IsMatch reports whether it can find a match somewhere in the input. Without boundaries, a pattern for a valid code can also match inside a larger invalid string. Use \A for the beginning of the input and \z for its absolute end when the requirement is whole-input validation. This avoids the newline and multiline subtleties associated with other anchors.
Define whether trimming is allowed before matching. Trimming the input changes the validation contract, and it can be inappropriate when spaces are meaningful. A pattern checks syntax, not existence or ownership. A structurally valid order identifier can still refer to no order. A plausible email shape cannot verify mailbox access. Use later application checks for those responsibilities and keep the pattern small enough that the syntax rule remains understandable.
Bound both input and matching work
A regex should not be allowed unlimited work on untrusted text. Bound the input length before matching and configure a timeout for patterns that can backtrack. A timeout failure is different from an ordinary nonmatch: it means the operation did not finish within the selected budget. Handle RegexMatchTimeoutException at the appropriate boundary without exposing the full sensitive input in a log message.
.NET 7 introduced RegexOptions.NonBacktracking for supported patterns, providing linear-time matching in the input length. It does not support every regex feature, so check compatibility instead of adding it blindly. The main example uses a simple compatible pattern and a finite timeout. The timeout is still an explicit resource contract. Avoid nested ambiguous repetition such as several overlapping quantified groups when a simpler exact grammar will do.
Escaping has two different layers
A pattern lives inside a C# string literal, so the string parser and regex parser both interpret syntax. A verbatim string such as @"\A...\z" keeps the backslashes visible to the regex engine. A normal string requires doubled backslashes. Raw strings are another option in modern C#, but do not remove the regex language's own special characters.
If user text must appear literally inside a pattern, pass that literal part through Regex.Escape. Otherwise characters such as a period or parenthesis can change the pattern's meaning. Escaping a literal fragment does not make an arbitrary user-supplied regex safe to execute. Treat a user-defined pattern as a separate advanced feature with length limits, resource controls and a clear trust model. Prefer equality or ordinary string methods when the task does not require pattern syntax.
Test grammar boundaries instead of one happy path
For a fixed code format, test the minimum and maximum lengths, missing separators, extra suffix text, lowercase letters, embedded newlines, and characters outside the intended alphabet. If the contract is ASCII, include a non-ASCII digit to prove that the rule is intentional. If case-insensitive matching is required, choose options and culture behavior deliberately.
Keep extraction tests separate from validation tests. A pattern might accept the line while capturing an unexpected group due to greediness or repetition. A quantified capturing group normally exposes the final capture through Value, while Captures exposes the sequence of captures. When a format grows into nested structures or escaped delimiters, consider an actual parser. Regex is not automatically the best tool merely because it can be made to match a sample.
Official references
C# Regular Expressions and Safe Matching Examples
Each example shows the code, the output it produces and what each part does.
Validate and extract a product code
The complete program validates the entire code and then reads its named numeric group. The regex instance is created once for this workflow, rather than being rebuilt for every input.
The first input matches both boundaries. The second has an extra prefix character, so finding a valid-looking substring would be insufficient. The third violates the exact digit count. A timeout is not expected for these tiny fixed inputs, but the handler defines how the boundary behaves if resource exhaustion is reported.
using System;
using System.Text.RegularExpressions;
var codePattern = new Regex(
@"\A(?<prefix>[A-Z]{2})-(?<number>[0-9]{4})\z",
RegexOptions.CultureInvariant | RegexOptions.NonBacktracking,
TimeSpan.FromMilliseconds(100));
foreach (string input in new[] { "AB-1234", "xAB-1234", "AB-12" })
{
if (input.Length > 20)
{
Console.WriteLine("Input too long");
continue;
}
try
{
Match match = codePattern.Match(input);
Console.WriteLine(match.Success
? $"Number: {match.Groups["number"].Value}"
: "Invalid code");
}
catch (RegexMatchTimeoutException)
{
Console.WriteLine("Validation unavailable");
}
}Number: 1234
Invalid code
Invalid codeC# Regular Expressions and Safe Matching in Real Projects
Worked exercise: extract a severity and message
The exercise accepts a bounded log line in the form LEVEL: message. Only INFO, WARN and ERROR are valid levels. The message must contain between one and eighty characters other than line breaks. The extractor should print the named values, and reject an unsupported level. This is extraction from a controlled single-line format, not a general parser for every logging system.
using System;
using System.Text.RegularExpressions;
var linePattern = new Regex(
@"\A(?<level>INFO|WARN|ERROR): (?<message>[^\r\n]{1,80})\z",
RegexOptions.NonBacktracking,
TimeSpan.FromMilliseconds(100));
foreach (string line in new[] { "WARN: Stock low", "DEBUG: Stock low" })
{
if (line.Length > 100)
{
Console.WriteLine("Invalid line");
continue;
}
try
{
Match match = linePattern.Match(line);
Console.WriteLine(match.Success
? $"{match.Groups["level"].Value}|{match.Groups["message"].Value}"
: "Invalid line");
}
catch (RegexMatchTimeoutException)
{
Console.WriteLine("Matching unavailable");
}
}WARN|Stock low
Invalid lineThe alternation limits the level to a finite vocabulary. The explicit message class rules out line breaks, while the quantifier bounds captured text. A later application can map the captured level to an enum and decide what to do with the message.
C# Regular Expressions and Safe Matching FAQ
Should every input validator use a regular expression?
No. Range checks, enum membership, numeric parsing and database existence checks are usually clearer with their dedicated APIs. A regex is useful for an explainable text grammar. Even then, it proves only syntax. A valid-looking date can be impossible, and a valid-looking identifier can refer to no record. Combine syntax checks with the domain checks required by the feature.
Why use absolute anchors instead of only IsMatch?
IsMatch can succeed on a substring. For whole-field validation, the pattern must require the entire input to conform. Absolute anchors \A and \z express that directly. Other anchors interact with options and newline behavior. A test containing valid-looking text followed by a newline or suffix is valuable because it exposes accidentally permissive boundaries.
Does NonBacktracking support every regex feature?
No. It supports a useful subset and excludes features such as backreferences and some constructs that rely on backtracking behavior. Choose it for compatible patterns rather than treating it as a universal switch. For other patterns, keep the expression simple, bound input length and use a finite timeout. Always verify the exact options against the target .NET version.
Should a timeout be reported as invalid input?
A timeout means matching did not complete, so it does not establish that the input fails the grammar. At a public boundary, return a safe unavailable or validation-failure response consistent with the application contract. Internally, record a bounded diagnostic without sensitive content. Do not repeatedly retry the same expensive pattern and input without changing the resource or pattern conditions.
C# Regular Expressions and Safe Matching Exercises
Answer each one and check it instantly. If you get stuck, open the hint before the answer.
A user-selected literal prefix must be inserted into a regex. What should the implementation do?
C# Regular Expressions and Safe Matching Quiz
2 questions to check what you learned.
A field must contain exactly two ASCII letters, a hyphen and four ASCII digits. Which detail matters?
- Removing anchors so a valid substring can be found.
- Using .* around the pattern to accept whitespace.
- Anchoring the whole input and specifying the intended character ranges.
- Replacing every character class with a wildcard.
What does RegexMatchTimeoutException establish?
- The input definitely fails the pattern.
- Every future match with this pattern will fail.
- The input contains no Unicode characters.
- Matching did not finish within the configured time budget.