title: How to trigger Regex Denial-of-Service in PHP?
body: <p>How can I trigger a Regex-DOS using the <code>preg_match()</code> function using an evil regular expression (e.g. <strong>(a+)+</strong> )?</p>
  
  <p>For example, I have the following situation:</p>
  
  <pre><code>preg_match('/(a+)+/',$input);
  </code></pre>
  
  <p>If I have control over <code>$input</code>, how could I trigger a <strong>DOS attack</strong> or reach the <strong>backtrack limit</strong> of the <code>preg_*</code> functions in php?</p>
  
  <p>How could I do this with the following expressions?</p>
  
  <pre><code>([a-zA-Z]+)*
  (a|aa)+
  (a|a?)+
  (.*a){x} | for x &gt; 10 
  </code></pre>