Character classes, ranges and negation

A hex colour such as #C0FFEE has six positions, and each one may hold any of 22 characters: the ten digits, A to F and a to f. Writing the 22 choices out for every position would be unreadable; a character classcharacter class: A part of a pattern between square brackets that matches exactly one character of the text: any one of the characters, ranges and classes listed inside it, such as [aeiou] for one vowel. says the same in eleven characters, [0-9A-Fa-f].

Below you will build classes from single characters and ranges, turn a class inside out with a caret, and meet the places where flavoursflavour: A particular regular-expression syntax and feature set, such as ECMAScript, Python re, PCRE2 or RE2; a pattern is written for one of them. More in “What a regular expression is and where it runs” part ways: JavaScript reads []a] as a class that can never match, [A-z] takes six symbols besides the letters, [[:alpha:]] means “a letter” in PCRE2 and Go but quietly matches nothing in JavaScript, and “a to z except the vowels” can be written as one class in some flavours only. Each example shows what its engine printed: JavaScript, Python, PCRE2, Go or PHP.

A class matches one character from a set

British English writes grey and American English gray. The pattern gr[ae]y finds both: g and r match themselves, then the class [ae] matches one character that is either a or e, then y matches the y. A class is one position of the pattern, never more: it does not match graey, where two letters stand between r and y, and it does not match gry, where there is none. The order of the members does not matter, so [ea] is the same class, and a member written twice changes nothing: [aa] is [a]. A class chooses between single characters; a choice between longer pieces, such as gray or grey or graey, is alternation with |, which a later module covers.

Inside the brackets the dot, the star and most other metacharactersmetacharacter: A character that carries a special meaning in a regex pattern. ECMAScript lists fourteen outside a character class: ^ $ \ . * + ? ( ) [ ] { } and |. A backslash before any one of them makes it literal. More in “Literals, metacharacters and the dot” are plain characters, so [.*] matches a dot or a star. A class can also hold the shorthand classes such as \d, which the next lesson covers.

A caret straight after the opening bracket turns the set inside out. [^0-9] is a negated classnegated class: A character class that starts with a caret right after the opening bracket, such as [^0-9]. It matches exactly one character that is not in the set, line breaks included.: one character that is not a digit. It is still one character, so it needs a character to look at, and it treats a line terminatorline terminator: A character that ends a line. ECMAScript lists four (U+000A, U+000D, U+2028 and U+2029). Python, Go and PCRE2 treat the line feed alone as the line terminator by default. The dot refuses line terminators without a dotAll flag. More in “Literals, metacharacters and the dot” like any other character. That is the difference from the dot, which stops at line breaks. Run the program and compare the last two lines:

// A character class matches ONE character from its set; [^…] matches one character outside it.
function show(pattern, text) {
  const m = text.match(pattern);
  const found = m ? `${JSON.stringify(m[0])} at ${m.index}` : 'no match';
  console.log(`${pattern} in ${JSON.stringify(text)}: ${found}`);
}

// One position, two allowed letters: a or e.
for (const word of ['grey', 'gray', 'graey', 'gry']) show(/gr[ae]y/, word);

// Negation: the first character that is NOT a digit.
show(/[^0-9]/, '4021-7');
// A negated class still needs a character: after the 7 there is none.
show(/7[^0-9]/, '4021-7');

// The dot stops at a newline; a negated class does not.
show(/a.b/, 'a\nb');
show(/a[^x]b/, 'a\nb');

/gr[ae]y/ in "grey": "grey" at 0
/gr[ae]y/ in "gray": "gray" at 0
/gr[ae]y/ in "graey": no match
/gr[ae]y/ in "gry": no match
/[^0-9]/ in "4021-7": "-" at 4
/7[^0-9]/ in "4021-7": no match
/a.b/ in "a\nb": no match
/a[^x]b/ in "a\nb": "a\nb" at 0

[^0-9] found the hyphen at position 4, the first character that is not a digit. 7[^0-9] found nothing, because the 7 is the last character and nothing follows it for the class to take. And a[^x]b matched across the line break that stopped a.b. PCRE2’s documentation makes the same point for its own classes, with [^a] as the example: whatever line ending is in force, that class matches a line break.

Ranges follow code points, not the alphabet

[A-z] looks like “any letter, capital or small”, and it accepts the underscore. A hyphen between two characters in a class makes a character rangecharacter range: Two characters joined by a hyphen inside a character class, such as a-z. It matches every character whose code point lies between the two, both included, so A-z also takes the six symbols between Z and a., and ECMAScript defines a range as every character whose value lies in the interval from the first to the last, both included. Python, PCRE2 and Go use the same rule. The value is the character’s code pointcode point: The number the Unicode standard assigns to a character, independent of how the character is stored in memory. More in “What a regular expression is and where it runs”, and in Unicode the capitals and the small letters are not neighbours: six symbols stand between Z and a, as the figure shows row by row.

The figure lays out the 58 code points from U+0041 to U+007A. The program tests each character around the range against [A-z] and against [A-Za-z], the class that names its two ranges separately, then counts both over all of ASCII:

// A range covers every code point from its first character to its last, so [A-z] holds more than letters.
const wide = /[A-z]/;
const letters = /[A-Za-z]/;
const hex = (ch) => 'U+' + ch.codePointAt(0).toString(16).toUpperCase().padStart(4, '0');
const yes = (re, ch) => (re.test(ch) ? 'yes' : 'no');

console.log('char  code point  [A-z]  [A-Za-z]');
for (const ch of '@AZ[\\]^_`az{') {
  console.log(`${ch.padEnd(6)}${hex(ch).padEnd(12)}${yes(wide, ch).padEnd(7)}${yes(letters, ch)}`);
}

// Count over all 128 ASCII characters.
let inWide = 0;
let inLetters = 0;
for (let cp = 0; cp < 128; cp++) {
  const ch = String.fromCodePoint(cp);
  if (wide.test(ch)) inWide++;
  if (letters.test(ch)) inLetters++;
}
console.log(`ASCII characters in [A-z]: ${inWide}, in [A-Za-z]: ${inLetters}`);

// A range must run upwards: a (U+0061) comes after Z (U+005A), so [a-Z] is refused.
try {
  new RegExp('[a-Z]');
  console.log('[a-Z] compiles');
} catch (e) {
  console.log(`[a-Z]: ${e.name}`);
}

char  code point  [A-z]  [A-Za-z]
@     U+0040      no     no
A     U+0041      yes    yes
Z     U+005A      yes    yes
[     U+005B      yes    no
\     U+005C      yes    no
]     U+005D      yes    no
^     U+005E      yes    no
_     U+005F      yes    no
`     U+0060      yes    no
a     U+0061      yes    yes
z     U+007A      yes    yes
{     U+007B      no     no
ASCII characters in [A-z]: 58, in [A-Za-z]: 52
[a-Z]: SyntaxError

[A-z] said yes to [, the backslash, ], ^, _ and the backtick, and [A-Za-z] said no to all six: 58 characters against 52. The last line shows the other way a range goes wrong. [a-Z] runs backwards, from U+0061 down to U+005A, and every flavour of this lesson refuses it when the pattern is compiled. Press Edit, put your own characters in the string the loop reads, such as a colon or an é, and run it again.

The safe habit is one range per block of characters you want, all inside one class. The ends of a range may also be code-point escapes, the forms the lesson on literals and the dot compared: [\u0900-\u097F] is the whole Devanagari block in JavaScript and in Python. A hex digit is three blocks, so [0-9A-Fa-f] holds three ranges and nothing else. Written once per position after a #, it finds six-digit and three-digit colours:

// Hex colours: one class for one hex digit, written once per digit.
const HEX = '[0-9A-Fa-f]';
const six = new RegExp('#' + HEX.repeat(6));
const three = new RegExp('#' + HEX.repeat(3));
console.log('six digits:  ', String(six));
console.log('three digits:', String(three));

const theme = ['#FF8800', '#0aF', '#12G4F0', '#fff', '#C0FFEE', '#1e90ff'];
for (const colour of theme) {
  const a = colour.match(six);
  const b = colour.match(three);
  console.log(`${colour.padEnd(8)} six: ${(a ? a[0] : '-').padEnd(8)} three: ${b ? b[0] : '-'}`);
}

six digits:   /#[0-9A-Fa-f][0-9A-Fa-f][0-9A-Fa-f][0-9A-Fa-f][0-9A-Fa-f][0-9A-Fa-f]/
three digits: /#[0-9A-Fa-f][0-9A-Fa-f][0-9A-Fa-f]/
#FF8800  six: #FF8800  three: #FF8
#0aF     six: -        three: #0aF
#12G4F0  six: -        three: -
#fff     six: -        three: #fff
#C0FFEE  six: #C0FFEE  three: #C0F
#1e90ff  six: #1e90ff  three: #1e9

#12G4F0 failed both patterns at the G, and every six-digit colour matched. The three-digit pattern also found #FF8 at the start of #FF8800, because nothing tells it where a colour ends. A later module adds anchors and counted repetition, which stop that and write the six classes as one.

Inside a class, escape the bracket, the hyphen and the caret

Inside a class only four characters have a job, as Literals, metacharacters and the dot listed: ] ends the class, the backslash escapes, ^ negates when it comes first, and - makes a range when it stands between two characters. To match one of them as itself, the flavours offer two ways: a position where the job cannot apply, or a backslash. The positions are where they disagree. Step through how JavaScript and three other engines read the same five characters, []a]+:

Python, PCRE2 and Go follow the POSIX rule that a ] right after the opening bracket is a member. JavaScript ends a class at the first ] wherever it stands, and ECMAScript defines the empty class [] as a set with no characters, which never matches. The same six probes ran in all four engines; the first three rows are about placement:

// Six class probes, the same in every engine of this lesson: JavaScript (V8) here.
const probes = [
  ['[]a]+', 'x]a]'],
  ['[\\]a]+', 'x]a]'],
  ['[+^-]', '2+3^4-1'],
  ['[A-z]+', 'Hello_[World]'],
  ['[[:alpha:]]+', 'ab1 cd'],
  ['a[^x]b', 'a\nb'],
];
for (const [pattern, text] of probes) {
  let result;
  try {
    const found = text.match(new RegExp(pattern, 'g'));
    result = found ? JSON.stringify(found) : 'no match';
  } catch (e) {
    result = `${e.name}: ${e.message}`;
  }
  console.log(`${pattern.padEnd(13)} on ${JSON.stringify(text).padEnd(16)} -> ${result}`);
}

[]a]+         on "x]a]"           -> no match
[\]a]+        on "x]a]"           -> ["]a]"]
[+^-]         on "2+3^4-1"        -> ["+","^","-"]
[A-z]+        on "Hello_[World]"  -> ["Hello_[World]"]
[[:alpha:]]+  on "ab1 cd"         -> no match
a[^x]b        on "a\nb"           -> ["a\nb"]

"""Six class probes, the same in every engine of this lesson: Python's re here.

re raises FutureWarning for a class that may change meaning in a later version; the warnings module catches it,
so the message prints beside its probe.
"""

import json
import re
import warnings

PROBES = [
    (r"[]a]+", "x]a]"),
    (r"[\]a]+", "x]a]"),
    (r"[+^-]", "2+3^4-1"),
    (r"[A-z]+", "Hello_[World]"),
    (r"[[:alpha:]]+", "ab1 cd"),
    (r"a[^x]b", "a\nb"),
]

for pattern, text in PROBES:
    with warnings.catch_warnings(record=True) as caught:
        warnings.simplefilter("always")
        found = re.findall(pattern, text)
    result = json.dumps(found, ensure_ascii=False, separators=(",", ":")) if found else "no match"
    print(f"{pattern:<13} on {json.dumps(text):<16} -> {result}")
    for warning in caught:
        print(f"{'':<13}    {warning.category.__name__}: {warning.message}")

[]a]+         on "x]a]"           -> ["]a]"]
[\]a]+        on "x]a]"           -> ["]a]"]
[+^-]         on "2+3^4-1"        -> ["+","^","-"]
[A-z]+        on "Hello_[World]"  -> ["Hello_[World]"]
[[:alpha:]]+  on "ab1 cd"         -> no match
                 FutureWarning: Possible nested set at position 1
a[^x]b        on "a\nb"           -> ["a\nb"]

// Six class probes, the same in every engine of this lesson: Go's regexp (RE2 syntax) here.
// The last line runs the newline probe again with CompilePOSIX, whose syntax flags leave out ClassNL.
package main

import (
	"encoding/json"
	"fmt"
	"regexp"
)

func show(pattern, text string, compile func(string) (*regexp.Regexp, error)) {
	quoted, _ := json.Marshal(text)
	result := "no match"
	re, err := compile(pattern)
	if err != nil {
		result = err.Error()
	} else if found := re.FindAllString(text, -1); found != nil {
		list, _ := json.Marshal(found)
		result = string(list)
	}
	fmt.Printf("%-13s on %-16s -> %s\n", pattern, quoted, result)
}

func main() {
	probes := [][2]string{
		{`[]a]+`, "x]a]"},
		{`[\]a]+`, "x]a]"},
		{`[+^-]`, "2+3^4-1"},
		{`[A-z]+`, "Hello_[World]"},
		{`[[:alpha:]]+`, "ab1 cd"},
		{`a[^x]b`, "a\nb"},
	}
	for _, p := range probes {
		show(p[0], p[1], regexp.Compile)
	}
	fmt.Println("The newline probe again, compiled with CompilePOSIX:")
	show(`a[^x]b`, "a\nb", regexp.CompilePOSIX)
}

[]a]+         on "x]a]"           -> ["]a]"]
[\]a]+        on "x]a]"           -> ["]a]"]
[+^-]         on "2+3^4-1"        -> ["+","^","-"]
[A-z]+        on "Hello_[World]"  -> ["Hello_[World]"]
[[:alpha:]]+  on "ab1 cd"         -> ["ab","cd"]
a[^x]b        on "a\nb"           -> ["a\nb"]
The newline probe again, compiled with CompilePOSIX:
a[^x]b        on "a\nb"           -> no match

"""Six class probes, the same in every engine of this lesson: PCRE2 10.49 here, through its test program pcre2test.

Each pattern line ends in /g (find every match); the indented line under it is the text, and each match prints as
" 0: <text>". In a text line, \\n stands for a newline, and pcre2test shows a matched newline as \\x0a.
"""

from pcre2_session import run

run(r'''
/[]a]+/g
    x]a]

/[\]a]+/g
    x]a]

/[+^-]/g
    2+3^4-1

/[A-z]+/g
    Hello_[World]

/[[:alpha:]]+/g
    ab1 cd

/a[^x]b/g
    a\nb
''')

$ pcre2test -q patterns.txt   (PCRE2 10.49)
/[]a]+/g
    x]a]
 0: ]a]

/[\]a]+/g
    x]a]
 0: ]a]

/[+^-]/g
    2+3^4-1
 0: +
 0: ^
 0: -

/[A-z]+/g
    Hello_[World]
 0: Hello_[World]

/[[:alpha:]]+/g
    ab1 cd
 0: ab
 0: cd

/a[^x]b/g
    a\nb
 0: a\x0ab

Row one is the split from the figure: no match in JavaScript, ]a] in the other three. Row two escapes the bracket, and all four agree. Row three, [+^-], works everywhere because the caret is not first and the hyphen is last. Row four repeats the range rule of the last section in all four engines: [A-z]+ took the underscore and both brackets of Hello_[World] into a single match. The position rules of row three hold until a pattern is edited: a member added after the hyphen turns it into a range, and a caret moved to the front negates the class. The table sums up how the two camps read each case:

The last row is the one to remember: escape all three, [\]\-\^], and every engine of this lesson reads the class the same way, JavaScript with the v flag included. An escaped caret that is not first was never needed, but it costs nothing and keeps its meaning when someone later moves it to the front. One exception lies outside these engines. POSIX tools such as grep read a backslash inside brackets as a plain backslash, so there the standard’s rule applies: put ] first and - last. A later module on tools covers grep.

POSIX names work in PCRE2 and Go, and fail silently in JavaScript

Row five of the same probes, [[:alpha:]]+ on the text ab1 cd, found ab and cd in PCRE2 and Go and nothing at all in JavaScript and Python. The double brackets are a POSIX bracket expressionPOSIX bracket expression: The POSIX name for a [...] class. It may hold class names such as [:alpha:] or [:digit:], as in [[:alpha:]]; PCRE2, Go and grep support those names, while JavaScript and Python read them as ordinary characters.: POSIX defines twelve class names that may stand inside a bracket expression: alnum, alpha, blank, cntrl, digit, graph, lower, print, punct, space, upper and xdigit, each written between [: and :]. The outer brackets are the class and the name is one member of it, so [[:alpha:][:digit:]] is a letter or a digit.

PCRE2 supports the names and gives them ASCII meanings unless Unicode properties are switched on (its UCP option), and Go lists [[:alpha:]] as an ASCII class equal to [A-Za-z]. JavaScript and Python’s re have no POSIX names. They read [[:alpha:] as an ordinary class of the characters [, :, a, l, p and h, and the last ] as a literal, so a match needs one of those characters followed by a ]. Python at least says something: FutureWarning, Possible nested set, because it reserves a class that starts with [ for nested classes in a later version.

What JavaScript makes of the same five characters depends on the flags. Run it with none, with u and with v:

// JavaScript has no POSIX names inside brackets. What it makes of [[:alpha:]] depends on the flags.
function show(label, source, flags, text) {
  let result;
  try {
    const found = text.match(new RegExp(source, flags + 'g'));
    result = found ? JSON.stringify(found) : 'no match';
  } catch (e) {
    result = e.name; // the wording of the message differs between engines
  }
  console.log(`${label.padEnd(8)} /${source}/${flags} on ${JSON.stringify(text)}: ${result}`);
}

show('no flag', '[[:alpha:]]+', '', 'ab1 cd');
show('no flag', '[[:alpha:]]+', '', 'a] :]');
show('u flag', '[[:alpha:]]+', 'u', 'ab1 cd');
show('v flag', '[[:alpha:]]+', 'v', 'ab1 cd');
show('v flag', '[[:alpha:]]+', 'v', 'alpha: ph');
show('ranges', '[A-Za-z]+', '', 'ab1 cd');

no flag  /[[:alpha:]]+/ on "ab1 cd": no match
no flag  /[[:alpha:]]+/ on "a] :]": ["a]",":]"]
u flag   /[[:alpha:]]+/u on "ab1 cd": SyntaxError
v flag   /[[:alpha:]]+/v on "ab1 cd": ["a"]
v flag   /[[:alpha:]]+/v on "alpha: ph": ["alpha:","ph"]
ranges   /[A-Za-z]+/ on "ab1 cd": ["ab","cd"]

Without flags the pattern quietly misses ab1 cd and matches the odd text a] :]. The u flag turns the lone ] into a SyntaxError, which at least fails at once. The v flag accepts nested classes, so [:alpha:] becomes a class of five characters and the pattern finds alpha: in the text alpha: ph. None of the three means “a letter”. To port a POSIX name, write the set it stood for: [A-Za-z] for the ASCII meaning, or a property such as \p{L} when every script’s letters should count.

Set operations build one class from others

The lowercase consonants are a to z without five letters, and with ranges alone they become [b-df-hj-np-tv-z], five ranges that are hard to read and easy to get wrong. Unicode’s regular expression standard, UTS #18, asks engines for union, intersection and set difference inside a class. A class set operationclass set operation: Building a character class from other classes by difference, intersection or union, such as [[a-z]--[aeiou]] with JavaScript's v flag: a to z without the vowels. Each flavour that has set operations spells them its own way. builds the consonants from two simpler sets.

JavaScript gained them with the v flag in ECMAScript 2024: [[a-z]--[aeiou]] takes the vowels away from a to z, and [[a-z]&&[^aeiou]] keeps what both sets share, which is the same set. Each operand is a whole class, a single character or a property such as the Unicode property escapeUnicode property escape: A pattern escape such as \p{L} (any letter) or \p{Nd} (any decimal digit) that matches characters by a Unicode property instead of a list; \P matches the rest. JavaScript needs the u or v flag for it, and Python's re module lacks it. More in “Shorthand classes for digits, words and spaces” \p{L}, any letter. Nesting alone is union: [[a-z][0-9]] with v is a letter from a to z or a digit. Press Edit, take y away as well by writing [[a-z]--[aeiouy]], and run it again:

// Set operations inside a class need the v flag (ES2024).
const text = 'regular expression x--a]';

// Difference: the letters a to z, minus the five vowels.
console.log('difference  ', JSON.stringify(text.match(/[[a-z]--[aeiou]]+/gv)));
// Intersection: the letters a to z that are also not vowels (the same set).
console.log('intersection', JSON.stringify(text.match(/[[a-z]&&[^aeiou]]+/gv)));
// Any letter of any script except a to z.
console.log('letters     ', JSON.stringify('Hello, Wörld'.match(/[\p{L}--[a-z]]/gv)));
// Without v the same characters are an ordinary class, [[a-z], then --[aeiou]] as text.
console.log('no v flag   ', JSON.stringify(text.match(/[[a-z]--[aeiou]]/g)));

// v mode also wants ( ) [ ] { } / - | escaped inside a class.
for (const source of ['[(]', '[\\(]', '[+-]', '[+\\-]']) {
  try {
    new RegExp(source, 'v');
    console.log(`/${source}/v compiles`);
  } catch (e) {
    console.log(`/${source}/v ${e.name}`);
  }
}

difference   ["r","g","l","r","xpr","ss","n","x"]
intersection ["r","g","l","r","xpr","ss","n","x"]
letters      ["H","W","ö"]
no v flag    ["x--a]"]
/[(]/v SyntaxError
/[\(]/v compiles
/[+-]/v SyntaxError
/[+\-]/v compiles

Without the v flag the same characters are an ordinary class followed by text, which matched x--a]. The v flag also asks for more escapes inside a class: the proposal that added it lists (, ), [, {, }, /, - and | as characters that must be escaped there, besides \ and ], so /[(]/v and /[+-]/v are SyntaxErrors and [+\-] compiles. The flavours that have set operations spell them differently:

The JavaScript, PCRE2, PHP, Python and Go rows ran; the tabs show what each printed for the same text:

// Consonants in JavaScript (V8, Node 24): set operations with the v flag, and what v mode refuses.
const text = 'regular expression x--a]';
for (const [source, flags] of [
  ['[[a-z]--[aeiou]]+', 'v'],
  ['[[a-z]--[aeiou]]', ''],
  ['[(]', 'v'],
  ['[a-z--aeiou]', 'v'],
]) {
  try {
    new RegExp(source, flags); // compiled without g first, so an error names the pattern as written
    const found = text.match(new RegExp(source, flags + 'g'));
    console.log(`/${source}/${flags} -> ${JSON.stringify(found)}`);
  } catch (e) {
    console.log(`/${source}/${flags} -> ${e.name}: ${e.message}`);
  }
}

/[[a-z]--[aeiou]]+/v -> ["r","g","l","r","xpr","ss","n","x"]
/[[a-z]--[aeiou]]/ -> ["x--a]"]
/[(]/v -> SyntaxError: Invalid regular expression: /[(]/v: Invalid character in character class
/[a-z--aeiou]/v -> SyntaxError: Invalid regular expression: /[a-z--aeiou]/v: Invalid set operation in character class

"""Consonants by set operations in PCRE2 10.49, through its test program pcre2test.

(?[ ... ]) is Perl's extended class, in PCRE2 from release 10.45; inside it, - takes one set away from another and
spaces are ignored. The alt_extended_class modifier sets PCRE2_ALT_EXTENDED_CLASS, which gives [...] itself the
UTS #18 operators --, && and ||. Without that option the same [...] is an ordinary class. Each match prints as " 0:".
"""

from pcre2_session import run

run(r'''
/(?[ [a-z] - [aeiou] ])+/g
    regular expression x--a]

/[[a-z]--[aeiou]]+/g,alt_extended_class
    regular expression x--a]

/[[a-z]--[aeiou]]/g
    regular expression x--a]

/(?[ \p{L} - [a-z] ])/g,utf
    Hello, W\x{f6}rld
''')

$ pcre2test -q patterns.txt   (PCRE2 10.49)
/(?[ [a-z] - [aeiou] ])+/g
    regular expression x--a]
 0: r
 0: g
 0: l
 0: r
 0: xpr
 0: ss
 0: n
 0: x

/[[a-z]--[aeiou]]+/g,alt_extended_class
    regular expression x--a]
 0: r
 0: g
 0: l
 0: r
 0: xpr
 0: ss
 0: n
 0: x

/[[a-z]--[aeiou]]/g
    regular expression x--a]
 0: x--a]

/(?[ \p{L} - [a-z] ])/g,utf
    Hello, W\x{f6}rld
 0: H
 0: W
 0: \x{f6}

<?php
// Consonants in PHP 8.5, whose preg functions use the PCRE2 library bundled with PHP.
// A pattern that does not compile makes preg_match_all() return false and raise a warning; the handler below prints
// the warning's message, so nothing else (such as the script's path) is printed.
set_error_handler(function (int $level, string $message): bool {
    echo "  warning: $message\n";
    return true;
});

echo 'PCRE2 ', explode(' ', PCRE_VERSION)[0], "\n";
$text = 'regular expression x--a]';
$patterns = ['/(?[ [a-z] - [aeiou] ])+/', '/[[a-z]--[aeiou]]/', '/[b-df-hj-np-tv-z]+/'];
foreach ($patterns as $pattern) {
    $count = preg_match_all($pattern, $text, $found);
    $result = $count === false ? 'false' : json_encode($found[0]);
    echo "$pattern -> $result\n";
}

PCRE2 10.44
  warning: preg_match_all(): Compilation failed: unrecognized character after (? or (?- at offset 2
/(?[ [a-z] - [aeiou] ])+/ -> false
/[[a-z]--[aeiou]]/ -> ["x--a]"]
/[b-df-hj-np-tv-z]+/ -> ["r","g","l","r","xpr","ss","n","x"]

"""Consonants in Python's re, which has no set operations yet.

re reads the set-operation syntax of other flavours (JavaScript's --, Java's &&) as ordinary characters of a class
and raises FutureWarning, because a later version may give it the UTS #18 meaning; the warnings module catches the
warning so its message prints under its pattern.
"""

import json
import re
import warnings

TEXT = "regular expression x--a]"

for pattern in (r"[[a-z]--[aeiou]]", r"[a-z&&[^aeiou]]", r"[b-df-hj-np-tv-z]+"):
    with warnings.catch_warnings(record=True) as caught:
        warnings.simplefilter("always")
        found = re.findall(pattern, TEXT)
    print(f"{pattern} -> {json.dumps(found, separators=(',', ':'))}")
    for warning in caught:
        print(f"  {warning.category.__name__}: {warning.message}")

[[a-z]--[aeiou]] -> ["x--a]"]
  FutureWarning: Possible nested set at position 1
[a-z&&[^aeiou]] -> ["a]"]
  FutureWarning: Possible set intersection at position 4
[b-df-hj-np-tv-z]+ -> ["r","g","l","r","xpr","ss","n","x"]

// Consonants in Go's regexp (RE2 syntax), which has no set operations.
package main

import (
	"encoding/json"
	"fmt"
	"regexp"
)

func main() {
	text := "regular expression x--a]"
	for _, pattern := range []string{`(?[ [a-z] - [aeiou] ])+`, `[[a-z]--[aeiou]]`, `[b-df-hj-np-tv-z]+`} {
		re, err := regexp.Compile(pattern)
		if err != nil {
			fmt.Printf("%s -> %v\n", pattern, err)
			continue
		}
		found, _ := json.Marshal(re.FindAllString(text, -1))
		fmt.Printf("%s -> %s\n", pattern, found)
	}
}

(?[ [a-z] - [aeiou] ])+ -> error parsing regexp: invalid or unsupported Perl syntax: `(?[`
[[a-z]--[aeiou]] -> ["x--a]"]
[b-df-hj-np-tv-z]+ -> ["r","g","l","r","xpr","ss","n","x"]

Python reads the JavaScript and the Java forms as ordinary classes too, and warns that a later version may give them meaning: Possible nested set, Possible set intersection. Of the five engines that ran, only JavaScript with v and PCRE2 10.49 found the consonants with a set operation; PHP, Python and Go found them only with the ranges written out. Where a flavour has no set operations, those ranges are the dependable fallback: write them, then test the characters at both ends of every range and the ones just outside them.

Practise: four classes, two flavours

Each task of the exercise names its flavour, because the two do not offer the same tools: in JavaScript the v flag lets you take digits or vowels away from a range, and in Python you write the ranges out yourself. The starter code holds one common mistake per task, and the sample tests run in your browser:

// Each name holds a character class that matches exactly one character. Each one below has a common mistake.

/** One hexadecimal digit, 0-9 or a-f in either case. */
export const HEX_DIGIT = /[0-9A-f]/;

/** One of ] - ^ \ and nothing else (the tests also try it with the v flag). */
export const SPECIAL = /[]-^\\]/;

/** One lowercase consonant, with the v flag and a set operation. */
export const CONSONANT = /[a-z]/v;

/** One Devanagari character (U+0900 to U+097F) that is not a Devanagari digit (U+0966 to U+096F). */
export const DEVANAGARI = /[\u{900}-\u{97F}]/v;

import { test, assert } from 'mysmartcopilot:test';
import { CONSONANT, DEVANAGARI, HEX_DIGIT, SPECIAL } from './patterns.mjs';

// A copy without g or y, so that test() never carries a position over from one call to the next.
const fresh = (re) => new RegExp(re.source, re.flags.replace(/[gy]/g, ''));
// The same class with the v flag (in place of u, which cannot be combined with v).
const withV = (re) => new RegExp(re.source, re.flags.replace(/[gyuv]/g, '') + 'v');

function check(re, yes, no) {
  const r = fresh(re);
  for (const ch of yes) assert.ok(r.test(ch), `${String(re)} should match ${JSON.stringify(ch)}`);
  for (const ch of no) assert.ok(!r.test(ch), `${String(re)} should not match ${JSON.stringify(ch)}`);
  assert.equal((yes[0] + yes[1]).match(r)[0], yes[0], `${String(re)} should match one character at a time`);
}

test('HEX_DIGIT: one hex digit in either case', () => {
  check(HEX_DIGIT, ['0', '9', 'a', 'f', 'A', 'F'], ['g', 'G', 'Z', '_', '[', '`', '-', ' ']);
});

test('SPECIAL: one of ] - ^ \\ and nothing else, also with the v flag', () => {
  const yes = [']', '-', '^', '\\'];
  const no = ['[', 'a', '_', '`', '.', '"'];
  check(SPECIAL, yes, no);
  let inV = null;
  try {
    inV = withV(SPECIAL);
  } catch {
    // v mode refused the class
  }
  assert.ok(inV, 'the class should also compile with the v flag: escape every character v mode reserves');
  check(inV, yes, no);
});

test('CONSONANT: a to z without the five vowels, by set difference in v mode', () => {
  assert.ok(CONSONANT.flags.includes('v'), 'use the v flag');
  assert.ok(CONSONANT.source.includes('--'), 'take the vowels away with --');
  check(CONSONANT, ['b', 'c', 'm', 'x', 'y', 'z'], ['a', 'e', 'i', 'o', 'u', 'B', '-', '[']);
});

test('DEVANAGARI: the block without its ten digits, by set difference in v mode', () => {
  assert.ok(DEVANAGARI.flags.includes('v'), 'use the v flag');
  assert.ok(DEVANAGARI.source.includes('--'), 'take the digits away with --');
  check(DEVANAGARI, ['क', 'ि', '।', 'ॐ', '\u0900', '\u097F'], ['०', '९', '५', '9', 'a', '\u0A05']);
});

"""Each name holds the text of a pattern: a character class that matches exactly one character.

The tests compile each one with re and fail on any warning. Each one below has a common mistake.
"""

# One hexadecimal digit, 0-9 or a-f in either case.
HEX_DIGIT = r"[0-9A-f]"

# One of ] - ^ \ and nothing else.
SPECIAL = r"[]-^\\]"

# One lowercase consonant. re has no set operations: write the consonants as ranges.
CONSONANT = r"[[a-z]--[aeiou]]"

# One Devanagari character (U+0900 to U+097F) that is not a Devanagari digit (U+0966 to U+096F).
DEVANAGARI = r"[\u0900-\u097F]"

import re
import warnings

from patterns import CONSONANT, DEVANAGARI, HEX_DIGIT, SPECIAL


def compiled(pattern):
    """Compiles the pattern with every warning turned into an error, so a FutureWarning fails the test."""
    with warnings.catch_warnings():
        warnings.simplefilter("error")
        return re.compile(pattern)


def check(pattern, yes, no):
    r = compiled(pattern)
    for ch in yes:
        assert r.search(ch), f"{pattern} should match {ch!r}"
    for ch in no:
        assert not r.search(ch), f"{pattern} should not match {ch!r}"
    assert r.search(yes[0] + yes[1]).group() == yes[0], f"{pattern} should match one character at a time"


def test_hex_digit():
    """HEX_DIGIT: one hex digit in either case"""
    check(HEX_DIGIT, ["0", "9", "a", "f", "A", "F"], ["g", "G", "Z", "_", "[", "`", "-", " "])


def test_special():
    """SPECIAL: one of ] - ^ \\ and nothing else"""
    check(SPECIAL, ["]", "-", "^", "\\"], ["[", "a", "_", "`", ".", '"'])


def test_consonant():
    """CONSONANT: a to z without the five vowels, as ranges"""
    check(CONSONANT, ["b", "c", "m", "x", "y", "z"], ["a", "e", "i", "o", "u", "B", "-", "["])


def test_devanagari():
    """DEVANAGARI: the block without its ten digits, as ranges"""
    check(DEVANAGARI, ["क", "ि", "।", "ॐ", "\u0900", "\u097f"], ["०", "९", "५", "9", "a", "\u0a05"])

Then test yourself on the five concepts. The self-check starts where your answers are weakest, explains every answer the moment you choose it, and brings a missed question back once before it ends:

Interview questions

Warm-up: what does a negated class such as [^0-9] match, and how is it different from the dot?

A negated class matches exactly one character that is not in its set: [^0-9] takes any single character except the ten ASCII digits, so it finds the hyphen in 4021-7. Two details separate it from the dot. The set is yours: the dot leaves out only line terminators, while [^0-9] leaves out what you list and nothing else. And a class never treats line terminators specially, so [^0-9] matches a newline that the dot, by default, does not. What it never matches is nothing at all: it must take one character, so 7[^0-9] fails at the end of 4021-7, where no character follows the 7. Go’s CompilePOSIX is an exception to the newline rule, because its classes leave the newline out.

The two questions below ask what happens when a class leaves the flavour it was written for: a POSIX name that moves to JavaScript, and a range that was meant to cover accented letters. Work out where each pattern goes wrong before you open its first step:

Key takeaways

• A character class matches exactly one character at one position, any one of its members; a caret right after the opening bracket negates it, and a negated class still takes one character, line breaks included, unlike the dot.
• A range covers every code point from its first character to its last, so [A-z] takes 58 characters instead of 52, and a backwards range such as [a-Z] is an error in every flavour of this lesson.
• JavaScript ends a class at the first ] and reads [] as a class that never matches, while Python, PCRE2 and Go take a first ] as a member, so the portable class escapes all three special characters: [\]\-\^].
• POSIX names such as [[:alpha:]] work in PCRE2 and Go; JavaScript turns them into a wrong class without any error, and Python into the same wrong class with a FutureWarning.
• Set operations build a class from others, written [[a-z]--[aeiou]] in JavaScript with the v flag, (?[ ... ]) in PCRE2 from 10.45, && in Java and -[...] in .NET, while Python, Go and PHP 8.5.11 need the ranges written out.