escape-string-regexp

escape-string-regexp is a tiny, zero-dependency JavaScript utility that escapes RegExp special characters in a string so it can be safely inserted into a RegExp constructor or interpolated into a larger pattern. It handles the standard special characters (| \ { } ( ) [ ] ^ $ + * ? .) with a simple backslash escape, and handles the hyphen (-) separately with a \x2d escape so the output stays valid both inside and outside character classes, including under the Unicode (u) flag.

Maintained by Sindre Sorhus as part of his widely used collection of single-purpose npm packages, it ships as native ESM with bundled TypeScript type definitions and has no runtime dependencies. Modern JavaScript engines now expose the same behavior natively via RegExp.escape(), which the README points readers to, but the package remains a stable, drop-in choice for code that targets older runtimes or already depends on it.

What You Get

• A single default-exported function, escapeStringRegexp(string), with no configuration or options to learn
• Correct escaping of all RegExp metacharacters (| \ { } ( ) [ ] ^ $ + * ? .) via backslash prefixing
• Unicode-flag-safe hyphen escaping using \x2d instead of a bare backslash
• Native ESM distribution with bundled TypeScript definitions (index.d.ts) and zero runtime dependencies

Common Use Cases

• Safely building a dynamic RegExp from user-supplied search text in a search-and-highlight feature
• Inserting an arbitrary string into the middle of a larger regular expression, such as a character class
• Sanitizing filenames, usernames, or tags before using them to construct a matching pattern
• Avoiding malformed-pattern bugs when regexes are built at runtime from untrusted input

Under The Hood

Architecture The entire package is a single ESM module, index.js, exporting one function with no internal layering, state, or side effects — a type-check guard followed by two chained String.replace calls, one for the standard metacharacter set and a second specifically for the hyphen. Type definitions live in a separate index.d.ts hand-written file rather than being generated from source, and index.test-d.ts exercises those types with tsd. There is no build step: the published package is the source as-is, which is appropriate given the function’s scope and keeps the dependency surface minimal for consumers.

Tech Stack Plain JavaScript targeting Node.js >=12, published as an ES module ("type": "module") with no runtime dependencies at all. The devDependencies are entirely tooling: ava for test execution, tsd for type-level assertions, and xo (Sindre Sorhus’s opinionated ESLint preset) for linting, all run through a single npm test script. CI (GitHub Actions) exercises the test suite across two Node major versions, though the workflow matrix (Node 12/14) has not been updated in some time.

Code Quality test.js uses ava to cover the three behaviors that actually matter for this function: escaping the full metacharacter set, escaping the hyphen in a PCRE-compatible way, and confirming the hyphen escape stays valid when the resulting pattern is compiled with the Unicode (u) flag. Type correctness is checked separately via tsd against index.test-d.ts. Linting is enforced through xo, and the one runtime error path — a non-string argument — throws an explicit TypeError rather than failing silently or coercing. For a ten-line implementation this is a proportionate, well-targeted test and lint setup rather than an under-tested one.

API Design The public surface is a single default export taking one argument and returning a string — there is no configuration object, no options, and no setup beyond npm install and one import line. The .d.ts file carries a runnable JSDoc example that surfaces directly in editor hover-docs, and the README documents the one non-obvious edge case (escaped strings inserted next to \0 or \c) explicitly rather than leaving it implicit. Overall the package asks essentially nothing of the consumer beyond calling the function correctly.