You write a regex. You test it against two or three sample strings. It matches perfectly. You ship it.
Three days later, someone opens a bug report titled "validation is broken" and attaches a screenshot that makes no sense to you, because the exact same pattern worked fine when you tried it.
If this has happened to you, you're not bad at regex. You just tested it the way most of us do — against clean, predictable, hand-picked strings. Production doesn't send you clean, predictable, hand-picked strings. It sends you whatever your users, your APIs, and your database actually contain.
Let's go through the specific reasons a regex that passes your tests can still fail in the real world, with examples for each one.
1. Greedy quantifiers eat more than you think
