Appendix D: Regular expressions : Cookbook regular expressions
 
Cookbook regular expressions
Some elements occur often in FortiWeb regular expressions, such as expressions to match domain names, URLs, parameters, and HTML tags. You can use these as building blocks for your own regular expressions.
 
For more expressions to match items such as SQL queries and URIs, see your FortiWeb’s list of predefined data types.
Table 76:  
To match...
You can use...
Line endings
(platform-independent)
(\r\n)|\n|\r
Any alphanumeric character
(ASCII only; e.g. does not match é or É)
[a-zA-Z0-9]
Specific domain name
(e.g. www.example.com; case insensitive)
(?i)\bwww\.example\.com\b
Any domain name
(valid non-internationalized TLDs only; does not match domain names surrounded by letters or numbers)
(?i)\b.*\.(a(c|d|e(ro)?|f|g|i|m|n|o|q|r|s(ia)?|t|y|w|x|z)|b(a|b|d|e|f|g|h|i(z)?|j|m|n|o|r|s|t|v|w|y|z)|c(a(t)?|c|d|f|g|h|i|k|l|m|n|o((m)?(op)?)|r|s|u|v|x|y|z)|d(e|j|k|m|o|z)|e(c|du|e|g|h|r|s|t|u)|f(i|j|k|m|o|r)|g(a|b|d|e|f|g|h|i|l|m|n|ov|p|q|r|s|t|u|w|y)|h(k|m|n|r|t|u)|i(d|e|l|m|n(fo)?(t)?|o|q|r|s|t)|j(e|m|o(bs)?|p)|k(e|g|h|i|m|n|p|r|w|y|z)|l(a|b|c|i|k|r|s|t|u|vy)|m(a|c|d|e|g|h|il|k|l|m|n|o(bi)?|p|q|r|s|t|u(seum)?|v|w|x|y|z)|n(a(me)?|c|e(t)?|f|g|i|l|o|p|r|u|z)|o(m|rg)|p(a|e|f|g|h|k|l|m|n|r(o)?|s|t|w|y)|qa|r(e|o|s|u|w)|s(a|b|c|d|e|g|h|i|j|k|l|m|n|o|r|s|t|u|v|y|z)|t(c|d|el|f|g|h|j|k|l|m|n|o|p|r(avel)?|t|v|w|z)|u(a|g|k|s|y|z)|v(a|c|e|g|i|n|u)|w(f|s)|xxx|y(e|t|u)|z(a|m|w))\b
Any domain name
(valid internationalized TLDs in UTF-8 only; does not match ASCII-encoded DNS forms such as xn--fiqs8s)
(?i)\b.*\.(tél\b|中国|中國|日本|新加坡|ישראל|台灣|الجزائر|বাংলা|مصر|გე|香港|भारत|بھارت|భారత్|ભારત|ਭਾਰਤ|இந்தியா|ভারত|ایران|الاردن|қаз|مليسيا|المغرب|عمان|рф|پاکستان|срб|فلسطين|قطر|சிங்கப்பூர்|السعودية|한국|سوريا|ලංකා|இலங்கை|ไทย|تونس|укр|امارات|台湾|اليمن)\b
Any sub-domain name
(?i)\b(.*)\.example\.com\b
Specific IPv4 address
\b10\.1\.1\.1\b
Any IPv4 address
\b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b
Specific HTML tag
(well-formed HTML only, e.g. <br> or <img src="1.gif" />; does not match the element’s contents between a tag pair; does not match the closing tag)
(?i)<\s*TAG\s*[^>]*>
Specific HTML tag pair and contained text/tags, if any
(well-formed HTML only; expression does not validate by DTD/Schema)
(?i)<\s*(TAG)\s*[^>]*>[^<]*</\1>
Any HTML tag pair and contained text/tags, if any
(well-formed HTML only; expression does not validate by DTD/Schema)
(?i)<\s*([A-Z][A-Z0-9]*)\b[^>]*>(.*?)</\1>
 
Any HTML comment
(?:<|<)!--[\s\S]*?--[ \t\n\r]*(?:>|>)
Any HTML entity
(well-formed entities only; expression does not validate by DTD/Schema)
&(?i)(#((x([\dA-F]){1,5})|(104857[0-5]|10485[0-6]\d|1048[0-4]\d\d|104[0-7]\d{3}|10[0-3]\d{4}|0?\d{1,6}))|([A-Za-z\d.]{2,31}));
JavaScript UI events
(onClick(), onMouseOver(), etc.)
(?i):on(blur|c(hange|lick)|dblclick|focus|keypress|(key|mouse)(down|up)|(un)?load|mouse(move|o(ut|ver))|reset|s(elect|ubmit))
All parameters that follow a question mark or hash mark in the URL
(e.g. #pageView or ?param1=valueA&param2=valueB...; back-reference to this match does not include the question/hash mark itself)
[#\?](.*)
See also
What are back-references?
Regular expression syntax