grep "^ERROR" log          # lines starting with ERROR
grep "\.py$" filelist      # lines ending with .py
grep -P "\berror\b" log    # "error" as whole word

grep "[[:digit:]]" file    # lines with at least one digit
grep "[[:space:]]$" file   # lines with trailing whitespace

grep -E "a{3}" file        # "aaa"
grep -E "[0-9]{1,3}" file  # 1-3 digit numbers
grep -E "https?" file      # "http" or "https"

grep -E "(error|warning|critical)" log
grep -E "^(GET|POST|PUT|DELETE) " access.log

# IP address (basic — doesn't validate ranges)
grep -E '^([0-9]{1,3}\.){3}[0-9]{1,3}$'

# Email (simplified)
grep -E '^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'

# ISO date (YYYY-MM-DD)
grep -E '^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])$'

# Semantic version
grep -E '^v?[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$'

# UUID
grep -E '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'

# Extract URLs
grep -oE 'https?://[^ >"]+' file

# Extract IP addresses
grep -oP '\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}' file

# Extract quoted strings
grep -oE '"[^"]*"' file

# Extract key=value pairs
grep -oE '[A-Z_]+=[^ ]+' file

# Reformat date: YYYY-MM-DD → DD/MM/YYYY
sed -E 's/([0-9]{4})-([0-9]{2})-([0-9]{2})/\3\/\2\/\1/g'

# Extract domain from URL
sed -E 's|https?://([^/]+).*|\1|'

# Remove HTML tags
sed -E 's/<[^>]+>//g'

# Normalize whitespace
sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//'

if [[ "$input" =~ ^[0-9]+$ ]]; then
    echo "It's a number"
fi

# Capture groups via BASH_REMATCH
if [[ "$date" =~ ^([0-9]{4})-([0-9]{2})-([0-9]{2})$ ]]; then
    year="${BASH_REMATCH[1]}"
    month="${BASH_REMATCH[2]}"
    day="${BASH_REMATCH[3]}"
fi

# Match "price" only if followed by a number
grep -P 'price(?=\s*\d)' file
# "price 42" ✓  "price tag" ✗

# Match a number NOT followed by "px"
grep -P '\d+(?!px)' file
# "100em" ✓  "100px" ✗ (the "100" part)

# Match a number preceded by "$"
grep -P '(?<=\$)\d+' file
# "$42" → matches "42"  "€42" ✗

# Match a word NOT preceded by "un"
grep -P '(?<!un)happy' file
# "happy" ✓  "unhappy" ✗

# Password validation: 8+ chars, at least one digit, one uppercase, one lowercase
grep -P '^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$'

# Extract values from key=value, but only the value (lookbehind)
grep -oP '(?<=API_KEY=)[^\s]+'

# Find "TODO" comments not followed by an assignee
grep -P 'TODO(?!\s*\([A-Za-z]+\))' *.py

# Match a domain, but not "localhost"
grep -P '(?<!local)host\.' config

# \K discards everything matched so far (PCRE alternative to lookbehind)
grep -oP 'price:\s*\K\d+' file
# "price: 42" → matches "42"

# VULNERABLE — user input matched against dangerous pattern
import re
pattern = re.compile(r'^(([a-z])+\.)+[A-Z]{2,}$')
# Attacker sends: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!"
# → server hangs

# SAFE — using atomic group equivalent via possessive quantifier
# Python's re module doesn't support possessive, but the regex library does:
import regex
pattern = regex.compile(r'^([a-z]++\.)+[A-Z]{2,}$')

# Quick test: time the match against a long non-matching string
time echo "aaaaaaaaaaaaaaaaaaaaaaaaaaaa!" | grep -P '(a+)+$'
# If it takes more than 0.01s, the pattern is vulnerable

import re

# Compile for reuse
pattern = re.compile(r'\d{4}-\d{2}-\d{2}')

# Search (first match)
match = pattern.search("Date: 2024-01-15 and 2024-02-20")
if match:
    print(match.group())     # "2024-01-15"
    print(match.start())     # 6

# Find all
dates = pattern.findall("2024-01-15 and 2024-02-20")
# ["2024-01-15", "2024-02-20"]

# Named groups
m = re.match(r'(?P<year>\d{4})-(?P<month>\d{2})-(?P<day>\d{2})', "2024-01-15")
m.group('year')   # "2024"
m.groupdict()     # {'year': '2024', 'month': '01', 'day': '15'}

# Substitution
re.sub(r'\bfoo\b', 'bar', "foo foobar foo")  # "bar foobar bar"

# Split
re.split(r'[,;\s]+', "a, b; c  d")  # ['a', 'b', 'c', 'd']

// Literal syntax (preferred)
const pattern = /\d{4}-\d{2}-\d{2}/g;

// Constructor (for dynamic patterns)
const dynamic = new RegExp(`user_${userId}`, 'i');

// Test (boolean)
/^\d+$/.test("42");              // true

// Match (array or null)
"2024-01-15".match(/(\d{4})-(\d{2})-(\d{2})/);
// ["2024-01-15", "2024", "01", "15"]

// Named groups (ES2018+)
const m = "2024-01-15".match(/(?<year>\d{4})-(?<month>\d{2})-(?<day>\d{2})/);
m.groups.year;                   // "2024"

// matchAll (ES2020+ — requires /g flag)
for (const m of text.matchAll(/\d+/g)) {
    console.log(m[0], m.index);
}

// Replace
"foo bar foo".replace(/foo/g, "baz");  // "baz bar baz"
"2024-01-15".replace(/(\d{4})-(\d{2})-(\d{2})/, "$3/$2/$1");  // "15/01/2024"

import java.util.regex.*;

Pattern pattern = Pattern.compile("\\d{4}-\\d{2}-\\d{2}");
Matcher matcher = pattern.matcher("Date: 2024-01-15");

if (matcher.find()) {
    System.out.println(matcher.group());   // "2024-01-15"
    System.out.println(matcher.start());   // 6
}

// Named groups
Pattern dated = Pattern.compile("(?<year>\\d{4})-(?<month>\\d{2})-(?<day>\\d{2})");
Matcher dm = dated.matcher("2024-01-15");
if (dm.matches()) {
    dm.group("year");    // "2024"
}

// Replace
"foo bar foo".replaceAll("\\bfoo\\b", "baz");  // "baz bar baz"

// Split
"a, b; c  d".split("[,;\\s]+");  // ["a", "b", "c", "d"]