Escape user input for use in JS regex
I'm not a fan of "sanitizing" data.  There isn't a clear definition of what "sanitizing" means, other than that it takes untrustworthy input and somehow makes it valid.  It might entail discarding the invalid parts of the input — which is not what you are doing here.  Escaping is a clearer term to describe what you are doing.

Repeated string concatenation is considered poor practice for performance.  Since JavaScript strings are immutable, it would be better to devise a solution that constructs the string "all at once".

The documentation on developer.mozilla.org suggests the following solution for escaping a regular expression:


  Escaping user input to be treated as a literal string within a regular
  expression can be accomplished by simple replacement:

function escapeRegExp(string){
  return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&amp;'); // $&amp; means the whole matched string
}



I strongly recommend replacing your custom solution with the standard recipe (including a citation).