Fortinet white logo
Fortinet white logo

User Guide

Frequently used regular expressions

Frequently used regular expressions

Some elements occur often in FortiWeb Cloud regular expressions, such as expressions to match domain names, URLs, parameters, and HTML tags. You can use these as building blocks for your own regular expressions.

To match... You can use...

Line endings

(platform-independent)

(\r\n)|\n|\r

Any alphanumeric character

(ASCII only; e.g. does not match é or É)

[a-zA-Z0-9]

Specific domain name

(e.g. www.example.com; case insensitive)

(?i)\bwww\.example\.com\b

Any domain name

(valid non-internationalized TLDs only; does not match domain names surrounded by letters or numbers)

(?i)\b.*\.(a(c|d|e(ro)?|f|g|i|m|n|o|q|r|s(ia)?|t|y|w|x|z)|b(a|b|d|e|f|g|h|i(z)?|j|m|n|o|r|s|t|v|w|y|z)|c(a(t)?|c|d|f|g|h|i|k|l|m|n|o((m)?(op)?)|r|s|u|v|x|y|z)|d(e|j|k|m|o|z)|e(c|du|e|g|h|r|s|t|u)|f(i|j|k|m|o|r)|g(a|b|d|e|f|g|h|i|l|m|n|ov|p|q|r|s|t|u|w|y)|h(k|m|n|r|t|u)|i(d|e|l|m|n(fo)?(t)?|o|q|r|s|t)|j(e|m|o(bs)?|p)|k(e|g|h|i|m|n|p|r|w|y|z)|l(a|b|c|i|k|r|s|t|u|vy)|m(a|c|d|e|g|h|il|k|l|m|n|o(bi)?|p|q|r|s|t|u(seum)?|v|w|x|y|z)|n(a(me)?|c|e(t)?|f|g|i|l|o|p|r|u|z)|o(m|rg)|p(a|e|f|g|h|k|l|m|n|r(o)?|s|t|w|y)|qa|r(e|o|s|u|w)|s(a|b|c|d|e|g|h|i|j|k|l|m|n|o|r|s|t|u|v|y|z)|t(c|d|el|f|g|h|j|k|l|m|n|o|p|r(avel)?|t|v|w|z)|u(a|g|k|s|y|z)|v(a|c|e|g|i|n|u)|w(f|s)|xxx|y(e|t|u)|z(a|m|w))\b
Any sub-domain name (?i)\b(.*)\.example\.com\b
Specific IPv4 address \b10\.1\.1\.1\b
Any IPv4 address \b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b

Specific HTML tag

(well-formed HTML only, e.g. <br> or <img src="1.gif" />; does not match the element’s contents between a tag pair; does not match the closing tag)

(?i)<\s*TAG\s*[^>]*>

Specific HTML tag pair and contained text/tags, if any

(well-formed HTML only; expression does not validate by DTD/Schema)

(?i)<\s*(TAG)\s*[^>]*>[^<]*</\1>

Any HTML tag pair and contained text/tags, if any

(well-formed HTML only; expression does not validate by DTD/Schema)

(?i)<\s*([A-Z][A-Z0-9]*)\b[^>]*>(.*?)</\1>

Any HTML comment (?:<|<)!--[\s\S]*?--[ \t\n\r]*(?:>|>)

Any HTML entity

(well-formed entities only; expression does not validate by DTD/Schema)

&(?i)(#((x([\dA-F]){1,5})|(104857[0-5]|10485[0-6]\d|1048[0-4]\d\d|104[0-7]\d{3}|10[0-3]\d{4}|0?\d{1,6}))|([A-Za-z\d.]{2,31}));

JavaScript UI events

(onClick(), onMouseOver(), etc.)

(?i):on(blur|c(hange|lick)|dblclick|focus|keypress|(key|mouse)(down|up)|(un)?load|mouse(move|o(ut|ver))|reset|s(elect|ubmit))

All parameters that follow a question mark or hash mark in the URL

(e.g. #pageView or ?param1=valueA&param2=valueB...; back-reference to this match does not include the question/hash mark itself)

[#\?](.*)

Frequently used regular expressions

Frequently used regular expressions

Some elements occur often in FortiWeb Cloud regular expressions, such as expressions to match domain names, URLs, parameters, and HTML tags. You can use these as building blocks for your own regular expressions.

To match... You can use...

Line endings

(platform-independent)

(\r\n)|\n|\r

Any alphanumeric character

(ASCII only; e.g. does not match é or É)

[a-zA-Z0-9]

Specific domain name

(e.g. www.example.com; case insensitive)

(?i)\bwww\.example\.com\b

Any domain name

(valid non-internationalized TLDs only; does not match domain names surrounded by letters or numbers)

(?i)\b.*\.(a(c|d|e(ro)?|f|g|i|m|n|o|q|r|s(ia)?|t|y|w|x|z)|b(a|b|d|e|f|g|h|i(z)?|j|m|n|o|r|s|t|v|w|y|z)|c(a(t)?|c|d|f|g|h|i|k|l|m|n|o((m)?(op)?)|r|s|u|v|x|y|z)|d(e|j|k|m|o|z)|e(c|du|e|g|h|r|s|t|u)|f(i|j|k|m|o|r)|g(a|b|d|e|f|g|h|i|l|m|n|ov|p|q|r|s|t|u|w|y)|h(k|m|n|r|t|u)|i(d|e|l|m|n(fo)?(t)?|o|q|r|s|t)|j(e|m|o(bs)?|p)|k(e|g|h|i|m|n|p|r|w|y|z)|l(a|b|c|i|k|r|s|t|u|vy)|m(a|c|d|e|g|h|il|k|l|m|n|o(bi)?|p|q|r|s|t|u(seum)?|v|w|x|y|z)|n(a(me)?|c|e(t)?|f|g|i|l|o|p|r|u|z)|o(m|rg)|p(a|e|f|g|h|k|l|m|n|r(o)?|s|t|w|y)|qa|r(e|o|s|u|w)|s(a|b|c|d|e|g|h|i|j|k|l|m|n|o|r|s|t|u|v|y|z)|t(c|d|el|f|g|h|j|k|l|m|n|o|p|r(avel)?|t|v|w|z)|u(a|g|k|s|y|z)|v(a|c|e|g|i|n|u)|w(f|s)|xxx|y(e|t|u)|z(a|m|w))\b
Any sub-domain name (?i)\b(.*)\.example\.com\b
Specific IPv4 address \b10\.1\.1\.1\b
Any IPv4 address \b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b

Specific HTML tag

(well-formed HTML only, e.g. <br> or <img src="1.gif" />; does not match the element’s contents between a tag pair; does not match the closing tag)

(?i)<\s*TAG\s*[^>]*>

Specific HTML tag pair and contained text/tags, if any

(well-formed HTML only; expression does not validate by DTD/Schema)

(?i)<\s*(TAG)\s*[^>]*>[^<]*</\1>

Any HTML tag pair and contained text/tags, if any

(well-formed HTML only; expression does not validate by DTD/Schema)

(?i)<\s*([A-Z][A-Z0-9]*)\b[^>]*>(.*?)</\1>

Any HTML comment (?:<|<)!--[\s\S]*?--[ \t\n\r]*(?:>|>)

Any HTML entity

(well-formed entities only; expression does not validate by DTD/Schema)

&(?i)(#((x([\dA-F]){1,5})|(104857[0-5]|10485[0-6]\d|1048[0-4]\d\d|104[0-7]\d{3}|10[0-3]\d{4}|0?\d{1,6}))|([A-Za-z\d.]{2,31}));

JavaScript UI events

(onClick(), onMouseOver(), etc.)

(?i):on(blur|c(hange|lick)|dblclick|focus|keypress|(key|mouse)(down|up)|(un)?load|mouse(move|o(ut|ver))|reset|s(elect|ubmit))

All parameters that follow a question mark or hash mark in the URL

(e.g. #pageView or ?param1=valueA&param2=valueB...; back-reference to this match does not include the question/hash mark itself)

[#\?](.*)