title: Regex in C - search for credit card numbers - PCI compliance
body: <p>Hey guys I am needing to meet a certain client demand for PCI . I am fairly comfortable in C and I really don't want to redo the wheel here. I have an regex example in python that I would like to have applied in C.</p>
  
  <pre><code>  pan_regexs = {'Mastercard': re.compile('(?:\D|^)(5[1-5][0-9]{2}(?:\ |\-|)[0-9]{4}(?:\ |\-|)[0-9]{4}(?:\ |\-|)[0-9]{4})(?:\D|$)'), \
                    'Visa': re.compile('(?:\D|^)(4[0-9]{3}(?:\ |\-|)[0-9]{4}(?:\ |\-|)[0-9]{4}(?:\ |\-|)[0-9]{4})(?:\D|$)'), \
                    'AMEX': re.compile('(?:\D|^)((?:34|37)[0-9]{2}(?:\ |\-|)[0-9]{6}(?:\ |\-|)[0-9]{5})(?:\D|$)')}
  </code></pre>
  
  <p>I have found some POSIX library "regex.h " and this seems to used the really old regex standard.</p>
  
  <p>I have found two examples one uses POSIX regex which seems to be limited at best. Stolen from <a href="https://stackoverflow.com/questions/1085083/regular-expressions-in-c-examples">Here</a></p>
  
  <pre><code>#include &lt;regex.h&gt;        
  regex_t regex;
  int reti;
  char msgbuf[100];
  
  /* Compile regular expression */
  reti = regcomp(&amp;regex, "^a[[:alnum:]]", 0);
  if (reti) {
      fprintf(stderr, "Could not compile regex\n");
      exit(1);
  }
  
  /* Execute regular expression */
  reti = regexec(&amp;regex, "abc", 0, NULL, 0);
  if (!reti) {
      puts("Match");
  }
  else if (reti == REG_NOMATCH) {
      puts("No match");
  }
  else {
      regerror(reti, &amp;regex, msgbuf, sizeof(msgbuf));
      fprintf(stderr, "Regex match failed: %s\n", msgbuf);
      exit(1);
  }
  
  /* Free memory allocated to the pattern buffer by regcomp() */
  regfree(&amp;regex);
  </code></pre>
  
  <p>The problem I see with the above is that it uses (from what I have gathered) Old Regex which doesn't support removing spaces and dashes.It also only really seems to perform some matching and looking for decent examples for this is not been turning many results for me in Google. So I looked further and in that answer it ( the question above) mentions the use of PCRE.</p>
  
  <p>I found some demo <a href="http://www.pcre.org/current/doc/html/pcre2demo.html" rel="nofollow noreferrer">Here</a></p>
  
  <p>As I said before, I don't want to reinvent the wheel . I think it would be terrible to write my own regex for what could contain potential flaws when something clean and simple probably exists.</p>
  
  <p>The PCI question comes from a client that we need to be able to monitor systems for how/where they are storing PANs and such. It's sort of a DLP, sphere of audit,and proving that CCNS are stored correctly.</p>
  
  <p>How can I use regex in C to search for credit card numbers? </p>
  
  <p>PS. I am ok with this regex, and open for better ways of doing this regex.</p>