This page needs a newer browser to run its tools. You can still read everything here.

Validation patterns and their limits interview questions

Interview questions on validation patterns and their limits: warm-ups, then what each harder question tests and how a good answer starts.

7 questions: 3 warm-ups and 4 with model answers · Levels: Fresher to senior

Warm-up questions

Short questions with short answers, each answered in full.

Fresher to mid

Why must a validator match the whole input, and how do the anchors differ by engine?

Answered in the lesson Validating formats: numbers, IDs and dates
Fresher to mid

Why is [0-9] safer than \d for an ID?

Answered in the lesson Validating formats: numbers, IDs and dates
Fresher to mid

Why can no regular expression prove that an email address works?

Answered in the lesson Emails, URLs and when to use a parser

Questions with model answers

What each question tests, the first step of a good answer and the follow-ups to expect.

Mid to senior

A bank-details form takes an IFSC, a MICR code, an account number, a UK sort code (six digits) and a SWIFT code (eight or eleven characters). Each format comes from a different issuer. Design the validation layer: what runs where, how do you report an error that a user can act on, and what is the test plan?
What it tests

Reading each format from its own issuer, running whole-input anchors and a length cap first, choosing where existence checks run, and writing a differential test plan for every field.

First step

List the fields and name the issuer of each one. For each format write a short sentence of the rule, straight from the issuer's page, and underline the parts a pattern can express. The patterns are the first layer; name the second layer (a parser, a lookup) and where it runs.
Follow-ups
- Which fields need an existence lookup rather than just a shape pattern, and where does the lookup run?
- How do you keep the error messages short enough to act on but specific enough to point at the field?
- What is the test plan: which near misses do you keep in a table, and why those?
- How do the Python and JavaScript sides of the form stay in step as the rules change?
From the lesson Validating formats: numbers, IDs and dates
Model answer, Pro. Model answers open with any pass; prices are in the notice on this page.
Opening the model answers with your pass…
Model answers open with any MySmartCoPilot pass.
Pro pass · 1 week₹79$2.99
30 days₹179$5.99
1 year₹1,699$45
One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.
Passes can’t be bought right now, so the model answers can’t be opened at the moment. If you have a pass, enter your licence key.
Choose a pass I have a licence key
It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 5 minutes
Mid to senior

A warehouse system accepts a product barcode and a batch date. A loss report shows that a scanner has sent invalid barcodes with the right shape and dates that no calendar has: the validator passed strings its downstream rejected. What was missing, and how do you fix it without changing the shape pattern?
What it tests

Separating the shape layer from the real check (a check digit and a calendar check), knowing which bugs each layer can catch, and designing a backfill for the strings the system already stored.

First step

Separate the two layers of the lesson. The barcode's shape is a regex; the real check is a GS1 check digit, a short loop. The date's shape is also a regex; the real check is datetime.date. Say which layer was missing in each case and where it belongs in the pipeline.
Follow-ups
- Which errors does a GS1 check digit catch that the shape pattern cannot?
- Could a tighter shape such as ([0-3][0-9])/([01][0-9])/([0-9]{4}) take over the calendar check, and where would it stop?
- How do you handle the records already in the database, where every string passes today's shape?
- What test would you add so that this class of bug fails loudly in a code review?
From the lesson Validating formats: numbers, IDs and dates
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
Mid to senior

After sign-in, a site sends the browser to the page named in a next parameter, and only the site's own pages may be targets. A Python service writes the Location header. How do you make its check and the browser agree on the target, and which inputs go into its tests?
What it tests

Seeing the browser as a second URL parser, resolving a relative target the way it does, comparing origins rather than strings, and building a test table from inputs that two parsers read differently.

First step

Name the two parsers first: the service's and the browser's. Then decide what a valid target may look like, such as a path on this site, say how it is turned into the URL the browser will follow, and say what must be equal before the header is written.
Follow-ups
- Why is a check that the value starts with a slash not enough?
- Which parser should the service use, and what if only urllib.parse is available?
- Which strings go into the test table, and what should each one produce?
- When would you stop accepting arbitrary targets altogether?
From the lesson Emails, URLs and when to use a parser
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 5 minutes
Mid to senior

A nightly job reads about 2 million support messages that customers wrote and stores every link in them for a report of the most shared pages. A third of last month's stored rows were junk, and some stored links carried password-reset tokens. How would you redesign the extraction?
What it tests

Splitting finding from deciding, bringing links to one stored form before counting them, treating query strings in customers' text as private data, and measuring what each stage drops.

First step

Sort last month's bad rows into kinds before changing anything: punctuation stuck to links, text that only looks like a link, and links that are real but private. Then give each kind to a stage: a pattern that finds candidates, a parser that decides, and a rule for what may be stored.
Follow-ups
- What does the stored form of a link look like, and why?
- Which parts of a URL would you never store, and how do you enforce that?
- How do you show that the new job is better than the old one?
- What changes if the report must also count links written without a scheme, such as www.shop.example?
From the lesson Emails, URLs and when to use a parser
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 5 minutes

All Regular Expressions interview questions · The Regular Expressions track

Your country

Validation patterns and their limits interview questions

Warm-up questions

Why must a validator match the whole input, and how do the anchors differ by engine?

Why is `[0-9]` safer than `\d` for an ID?

Why can no regular expression prove that an email address works?

Questions with model answers

After sign-in, a site sends the browser to the page named in a `next` parameter, and only the site's own pages may be targets. A Python service writes the Location header. How do you make its check and the browser agree on the target, and which inputs go into its tests?

A nightly job reads about 2 million support messages that customers wrote and stores every link in them for a report of the most shared pages. A third of last month's stored rows were junk, and some stored links carried password-reset tokens. How would you redesign the extraction?

Warm-up questions

Why must a validator match the whole input, and how do the anchors differ by engine?

Why is [0-9] safer than \d for an ID?

Why can no regular expression prove that an email address works?

Questions with model answers

After sign-in, a site sends the browser to the page named in a next parameter, and only the site's own pages may be targets. A Python service writes the Location header. How do you make its check and the browser agree on the target, and which inputs go into its tests?

A nightly job reads about 2 million support messages that customers wrote and stores every link in them for a report of the most shared pages. A third of last month's stored rows were junk, and some stored links carried password-reset tokens. How would you redesign the extraction?

Why is `[0-9]` safer than `\d` for an ID?

After sign-in, a site sends the browser to the page named in a `next` parameter, and only the site's own pages may be targets. A Python service writes the Location header. How do you make its check and the browser agree on the target, and which inputs go into its tests?