Developer
Jun 24, 2026
Missing a Regex Anchor Is a Bug — Why ^, $, and \b Work Differently Than You Think in Multiline Mode
The difference between a regex that matches "digits" and one that matches "only digits" is anchor characters — and missing anchors are why input validators accept strings they should reject. Here's how ^ and $ change behavior in multiline mode (a security-relevant surprise), why \b word boundaries break on Unicode text, the \z vs $ distinction for absolute string-end matching in Python, and why unanchored authorization patterns misclassify URLs.