quotemeta()

The PHP quotemeta() function adds a backslash before every character that has a special meaning in a regular expression, returning a new "escaped" string. Use it when you want to take an arbitrary piece of text and match it literally inside a pattern, so that characters like ., *, or ( are treated as plain text instead of regex operators.

This page covers the syntax, exactly which characters get escaped, a worked example, the common pitfall around delimiters, and when to reach for the better-suited preg_quote() instead.

Syntax

quotemeta(string $str): string

It takes a single argument:

• $str — the input string to escape.

It returns a new string with the special characters escaped. The original string is not modified. If $str is an empty string, an empty string is returned.

Which characters are escaped

quotemeta() puts a backslash in front of each of these characters:

.  \  +  *  ?  [  ^  ]  $  (  )

That is the complete list. Anything not in this set — including !, ,, =, -, {, }, and | — is left untouched. This is a frequent source of confusion: quotemeta() does not escape every "punctuation" character, only the eleven listed above.

Basic example

This produces:

Hello\^World!

The ^ is escaped because it is a regex metacharacter, while the ! is left alone — it is not in the escaped set.

A more complete example

To see the full behavior, escape a string that contains several metacharacters:

<?php
$pattern = 'price: $9.99 (per item)*';
echo quotemeta($pattern);
?>

Output:

price: \$9\.99 \(per item\)\*

Notice that the space, the colon, and the digits are unchanged, while $, ., (, ), and * each gain a backslash.

Why you would use it

The point of escaping is to match user-supplied text literally. Without escaping, a search term like a.b would match axb, a-b, and any other a + character + b, because . means "any character" in a regex:

<?php
$term = 'a.b';
$haystack = 'axb';

// Unescaped: '.' acts as a wildcard and matches 'x'
var_dump((bool) preg_match("/$term/", $haystack));

// Escaped: '.' is treated literally, so it does not match
$escaped = quotemeta($term);
var_dump((bool) preg_match("/$escaped/", $haystack));
?>

Output:

bool(true)
bool(false)

quotemeta() vs preg_quote()

quotemeta() predates PHP's PCRE engine and does not escape every character that PCRE treats as special — for instance it ignores {, }, |, and /. It also cannot escape your pattern delimiter.

For PCRE patterns (preg_match(), preg_replace(), and friends) you should almost always prefer preg_quote(), which escapes the full PCRE metacharacter set and accepts an optional delimiter argument so the delimiter itself is escaped too:

<?php
$term = 'a/b';
echo preg_quote($term, '/'); // a\/b
?>

Reach for quotemeta() only for the limited POSIX-style cases it was designed for; for everything regex-related in modern PHP, use preg_quote().

Related functions

• preg_quote() — escape a string for use in a PCRE pattern (the recommended choice).
• preg_match() — perform a regular expression match.
• preg_replace() — search and replace using a regular expression.
• addslashes() — escape quotes and backslashes for string literals, not regexes.

Practice