Browse and test common security-focused regex patterns for input validation, XSS prevention, and SQL injection detection.
Security regexes are blunt instruments: a single pattern of alternations and character classes that flags text resembling SQL injection, script payloads, or malformed input. This tool organizes a library of such patterns by category and lets you paste any string into a test box to see every match with its position. The surprise most users hit: a match is not a verdict. The pattern fired on literal text, nothing more. Benign strings trip these patterns constantly, and crafted payloads slip past them. They help you recognize and audit suspicious input, not sanitize or protect it.
A concrete input and expected output from the current implementation.
Input
Pattern: ('|--|;/\*|\*/) Test string: Robert'); DROP TABLE Students;-- Expected output
4 matches. First at index 6: the single quote. Also matched: ';' at index 8, ';' at index 29, and '--' at indices 30-31.
The pattern alternates among SQL metacharacters - apostrophe, double hyphen, semicolon, and comment markers - and the scanner reports every occurrence in order, so the first hit is the apostrophe after 'Robert'. Note what the tool does not do: it does not judge whether the string is a working attack, only that it contains the flagged characters.
Patterns are grouped by threat class - input validation, XSS payloads, SQL injection - and each entry shows the regex source, a plain-language description of what it is meant to catch, and a test box. Choosing a pattern loads it as the active pattern in the tester, and the listed example strings give you ready-made inputs to try against it.
The tester scans your pasted string for every occurrence of the active pattern and reports the number of matches and their character positions. This is pure text matching: nothing is executed, decoded, or evaluated, and the run happens locally in your browser. Standard regex semantics apply, so alternation order, character classes, anchors, and flags all change what counts as a match.
No. It only means this particular set of patterns did not fire on this exact string. Attack payloads are open-ended: encodings, case tricks, comments, and newlines produce variants these patterns miss. Treat the tester as a screening tool, and put the real defense in parameterized queries and output encoding rather than in regexes.
Mostly yes, with two caveats. Escaping changes between languages, so a pattern written for this tester needs different string escapes in Python, PHP, or a WAF rule language, and flag settings rarely survive copy-paste. Test the deployed pattern against both attack payloads and legitimate input first: over-matching will block real users.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.