What potential pitfalls should be considered when using regex to validate user input in PHP?

When using regex to validate user input in PHP, potential pitfalls to consider include: 1. Overly complex regex patterns can lead to performance issues. 2. Incorrect regex patterns may result in false positives or negatives. 3. Lack of proper input sanitization can leave the application vulnerable to injection attacks. 

// Example of using regex to validate an email address input in PHP
$user_input = $_POST['email'];

// Validate email address using a simple regex pattern
if (preg_match('/^\w+([\.-]?\w+)*@\w+([\.-]?\w+)*(\.\w{2,3})+$/', $user_input)) {
    echo "Valid email address";
} else {
    echo "Invalid email address";
}

Keywords

regex validation user input PHP security

Related Questions