I will plagiarize myself from my blog post, When to use and when not to use regular expressions ...
Public websites should not allow users to enter regular expressions to search. Providing the full power of regular expression to the general public for a websiteβs search engine can have a devastating effect. There is such a thing as a regular service rejection attack (ReDoS) that should be avoided at all costs.
HTML / XML parsing should not be done using regular expressions. First of all, regular expressions are intended for the analysis of an ordinary language , which is the simplest among the Chomsky hierarchy . Now, with the advent of balancing group definitions in the .NET regular expression expression, you can move on to a slightly more complex area and do a few things with XML or HTML in controlled situations. However, not so much. Parsers are available for both XML and HTML, which will facilitate the work more efficiently and reliably. In .NET, XML can be handled in the old XmlDocument way, or even easier with Linq to XML . Or for HTML there is an HTML Agility Pack .
Conclusion
Regular expressions use them. I still claim that in many cases they can save the programmer a lot of time and effort. Of course, given the infinite time and resources, it was almost always possible to create a procedural solution that was more effective than the equivalent regular expression.
Your decision to refuse regular expression should be based on three things:
1.) Is the regex so slow in your script that it has become a bottleneck?
2.) Is your procedural decision actually faster and easier to write than a regular expression?
3.) Is there a specialized parser that will do the job better?
source share