Strings & Regular Expressions

A String cannot change after creation because its value array is private and final and no method mutates it. Immutability makes strings safe to share across threads, safe as map keys, cacheable (hash code, pool) and safe to pass to security-sensitive APIs.

• Thread safety without locking.
• hashCode is computed once and cached in the hash field.
• Class loading, file paths, URLs and DB credentials cannot be altered after validation (no TOCTOU change).
• Enables the string pool and substring/concat optimizations.

The string pool is a JVM-wide table of canonical String instances. String literals and compile-time constant expressions are interned, so identical literals share one object.

• Since Java 7 the pool lives on the heap (it was in PermGen in Java 6), so pooled strings are garbage collectable.
• The pool is a native hash table; default size is 65536 buckets in modern JDKs (-XX:StringTableSize).
• new String("a") creates a separate heap object that is not the pooled instance.

intern() returns the canonical pooled instance equal to this string, adding this string to the pool if no equal one exists.

• Useful to dedupe millions of repeated values (country codes, tags) when parsed from external input.
• Cost: a pool lookup that is slower than a HashMap of your own for large volumes, and contention on a shared table.
• Prefer an application-level Map<String,String> or Interner (Guava) for controlled dedup, or G1's -XX:+UseStringDeduplication for the backing arrays.

== compares references; equals compares character content. Two strings with the same content can be different objects, so use equals for logic.

• equals first checks identity, then instanceof String, then coder (LATIN1/UTF16) and bytes.
• Use equalsIgnoreCase for case-insensitive comparison and "lit".equals(x) to avoid NPE.
• Objects.equals(a, b) is null-safe on both sides.

Up to two: the literal "abc" (pooled, created once when the class resolves it if not already present) and a new heap String from the constructor.

• If "abc" is already in the pool, only one new object is created at this statement.
• The copy constructor shares the internal byte array in modern JDKs, so the extra cost is the String header, not the data.
• The constructor is almost never needed; it only matters to detach from a large parent string in old JDKs.

String is immutable; StringBuilder is a mutable, unsynchronized buffer; StringBuffer is the same API with synchronized methods.

• StringBuilder is the default choice for single-threaded building.
• StringBuffer (since 1.0) pays locking cost; even then compound operations across calls are not atomic.
• Both share AbstractStringBuilder, doubling capacity (old * 2 + 2) when full.
• Neither overrides equals/hashCode (identity based); StringBuilder implements Comparable since Java 11.

The default capacity is 16. When an append would exceed capacity, the new capacity becomes max(required, old * 2 + 2) and the array is copied.

• Pass an expected size: new StringBuilder(expectedLength).
• setLength(0) reuses the buffer; trimToSize() releases excess.
• new StringBuilder(String s) allocates s.length() + 16.

Since Java 9 (JEP 254) a String stores a byte[] plus a coder flag: LATIN1 (1 byte per char) when all chars are <= 0xFF, otherwise UTF16 (2 bytes per char). Java 8 always used char[] (2 bytes).

• Typical heaps shrink 10-25% because most strings are Latin-1.
• A single non-Latin-1 character makes the entire string UTF16.
• -XX:-CompactStrings disables it.
• length() and charAt() remain O(1); charAt branches on coder.

Up to Java 8, javac compiled a + b into new StringBuilder().append(a).append(b).toString(). Since Java 9 (JEP 280) it emits an invokedynamic call to StringConcatFactory, which picks an optimal strategy at runtime.

• The bootstrap computes the exact final length and allocates once, avoiding intermediate buffers.
• Compile-time constants ("a" + "b", final locals) are folded by javac and become one pooled literal.
• Concatenation in a loop still creates a new string per iteration, so use StringBuilder there.

When every operand is a compile-time constant expression: literals, and final variables initialized with constants. The result is interned like a literal.

final String a = "ja";
String b = "ja";
System.out.println(("ja" + "va") == "java"); // true
System.out.println((a + "va") == "java");    // true
System.out.println((b + "va") == "java");    // false

• A final field or local assigned from a method call is not a constant.

Yes since Java 7. javac switches on hashCode() first, then confirms with equals inside each hash bucket, and finally switches on an int index.

• A null selector throws NullPointerException (unless case null in Java 21 pattern switch).
• Case labels must be constant expressions and unique.
• Hash collisions such as "Aa" and "BB" are handled by the equals check.

Java 14+ switch expressions use -> arms that yield a value, never fall through and must be exhaustive (a default is required for strings).

int days = switch (month) {
    case "feb" -> 28;
    case "apr", "jun", "sep", "nov" -> 30;
    default -> 31;
};

Java 11 added isBlank(), strip(), stripLeading(), stripTrailing(), lines() and repeat(int). Java 12 added indent/transform; Java 15 added formatted and stripIndent/translateEscapes.

• strip() removes Unicode whitespace (Character.isWhitespace); trim() removes chars <= U+0020 only.
• lines() returns a Stream<String> split on \n, \r, \r\n, without terminators.
• "ab".repeat(3) gives ababab; repeat(0) gives empty; negative throws IllegalArgumentException.
• "x=%d".formatted(5) is String.format as an instance method.

trim() removes characters with code <= U+0020 (space, tab, control chars). strip() removes characters for which Character.isWhitespace(int) is true, including Unicode spaces such as U+2003 (em space).

• Neither removes the non-breaking space U+00A0, because isWhitespace excludes it.
• Both return the same instance if nothing needs stripping.

Text blocks (standard in Java 15) are multi-line literals delimited by """. The opening delimiter must be followed by a line terminator.

String json = """
    {
      "name": "Ann"
    }
    """;

• Incidental indentation is removed using the least-indented line (including the closing delimiter line).
• Trailing spaces on each line are stripped; line endings are normalized to \n.
• \ at line end suppresses the newline; \s keeps a trailing space.
• Quotes need no escaping except a sequence of three.

A Java char is a 16-bit UTF-16 code unit. A code point is a Unicode scalar value (0 to 0x10FFFF); those above 0xFFFF need two chars (a surrogate pair). A grapheme is what users perceive as one character and may be several code points.

• length() counts code units; codePointCount(0, len) counts code points.
• "😀".length() is 2, codePointCount is 1.
• Iterate with codePoints() or Character.charCount.
• User-perceived characters (flag emoji, "e" plus combining accent) need BreakIterator or regex \X (Java 9+).

Unicode is the catalogue of code points; UTF-8, UTF-16 and ISO-8859-1 are encodings turning them into bytes.

• UTF-8: 1-4 bytes, ASCII compatible, no endianness issue; the web default.
• UTF-16: 2 or 4 bytes per code point; Java's in-memory form.
• ISO-8859-1: 1 byte, covers U+0000-U+00FF only; unmappable characters become ?.
• Always pass a charset explicitly: getBytes(StandardCharsets.UTF_8).

JEP 400 makes UTF-8 the default charset for the JVM (Charset.defaultCharset()) regardless of OS locale. Before 18 it came from file.encoding/locale (e.g. Cp1252 on Windows).

• System.out encoding and console use stdout.encoding, which can still differ.
• -Dfile.encoding=COMPAT restores the old behaviour.
• Best practice stays: specify the charset explicitly in Files, InputStreamReader, getBytes.

new String(bytes, charset) never throws; malformed or unmappable input is replaced with U+FFFD, and mis-decoding valid bytes yields mojibake (e.g. UTF-8 é decoded as Latin-1 becomes é).

• For strict validation use CharsetDecoder with CodingErrorAction.REPORT.
• Data lost via replacement cannot be recovered by re-encoding.
• Round-tripping through Latin-1 is lossless for bytes, which is occasionally used to carry binary data (not recommended; use Base64).

String.format(fmt, args...) parses a format string with specifiers %[argument_index$][flags][width][.precision]conversion using java.util.Formatter.

• Common conversions: %s (any, uses toString), %d, %f, %x, %c, %b, %n (platform newline), %%, %e.
• %08.3f zero-pads width 8 with 3 decimals; %,d adds grouping; %-10s left-aligns.
• %2$s %1$s selects arguments by index.
• A mismatch throws IllegalFormatException subclasses at runtime (MissingFormatArgumentException, IllegalFormatConversionException).

Every call parses the format string with a regex-free but nontrivial parser, creates a Formatter, boxes primitives and allocates a StringBuilder. It is several times slower than concatenation or StringBuilder.

• Avoid in hot paths and in log statements; use parameterized logging (log.debug("x={}", x)).
• Fine for infrequent messages and reports.
• "x".formatted(...) has the same cost, only a different syntax.

A String is immutable and stays in memory (and possibly pooled or in heap dumps) until GC; you cannot wipe it. A char[] can be overwritten with Arrays.fill(chars, '\0') immediately after use.

• Console.readPassword() and Swing JPasswordField.getPassword() return char[].
• It does not protect against everything: heap dumps taken earlier, GC copying, and frameworks that convert to String (HTTP params, JSON) defeat it.
• Prefer hashed verification (bcrypt, Argon2) so the plaintext lives briefly.

s[0]*31^(n-1) + s[1]*31^(n-2) + ... + s[n-1] in int arithmetic with overflow, over the chars (code units). The result is cached in the hash field (with a hashIsZero flag since Java 13 so zero hashes are also cached).

• 31 is an odd prime and 31 * i == (i << 5) - i, cheap for the JIT.
• The algorithm is specified, so it is stable across JVMs and runs, unlike Object.hashCode.
• Collisions are easy to build: "Aa" and "BB" both give 2112.

split(regex) takes a regular expression, not a literal, and drops trailing empty strings by default.

• "a.b".split(".") returns an empty array because . matches every char; use "\\." or Pattern.quote(".").
• "a,b,,".split(",") gives [a, b]; use split(",", -1) to keep trailing empties.
• A leading empty string is kept when there is a positive-width match at index 0: ",a".split(",") is ["", "a"]; a zero-width match at the start never produces one (Java 8+).
• "".split(",") returns [""] (length 1), while " ".split(" ") returns an empty array (length 0).
• split has a fast path (no regex) for single non-metachar and escaped single char.

With limit n > 0 the array has at most n elements and the last holds the unsplit remainder; n == 0 drops trailing empties and is the default; n < 0 keeps all, including trailing empties.

"a:b:c".split(":", 2);   // [a, b:c]
"a:b::".split(":", -1);  // [a, b, , ]
"a:b::".split(":");      // [a, b]

replace(CharSequence, CharSequence) and replace(char, char) are literal and replace all occurrences. replaceAll and replaceFirst take a regex and treat $ and \ in the replacement specially.

• "a.b".replace(".", "-") gives a-b; replaceAll(".", "-") gives ---.
• Replacement with $1 refers to group 1; use Matcher.quoteReplacement for literal text.
• replaceAll compiles a new Pattern each call, so precompile for hot loops.

Pattern is the compiled, immutable, thread-safe regex. Matcher is a stateful engine for one input and is not thread-safe. PatternSyntaxException reports bad syntax; MatchResult is a snapshot of a match.

• Pattern.compile(regex, flags) once, reuse; p.matcher(input) per use.
• matches() requires the full region to match; find() searches for the next match; lookingAt() anchors at the start only.
• Pattern.matches(regex, s) and String.matches recompile every time.

Parentheses capture. Groups are numbered by their opening parenthesis from 1; group 0 is the whole match. Named groups use (?<name>...), backreferences use \1 or \k<name>.

Matcher m = Pattern.compile("(?<y>\\d{4})-(?<m>\\d{2})").matcher("2026-10");
if (m.matches()) System.out.println(m.group("y") + "/" + m.group(2)); // 2026/10

• (?:...) is a non-capturing group.
• Group names must be alphanumeric and start with a letter (no underscores).
• Replacement refs: $1 or ${name}.

Greedy (*, +, ?, {n,m}) takes as much as possible then backtracks. Lazy (*?) takes as little as possible and expands. Possessive (*+) takes as much as possible and never gives back.

• On <a><b>: <.*> matches the entire string; <.*?> matches <a>; <.*+> fails because it consumes > and cannot backtrack.
• Possessive quantifiers and atomic groups (?>...) prevent catastrophic backtracking.

Lookarounds are zero-width assertions: (?=x) positive lookahead, (?!x) negative lookahead, (?<=x) positive lookbehind, (?<!x) negative lookbehind. They check context without consuming characters.

• Password rule: ^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,}$.
• Thousands separator: \B(?=(\d{3})+(?!\d)).
• Java lookbehind needs a bounded maximum length: (?<=ab{1,3}) is fine, while unbounded (?<=a+) is rejected or unreliable, so avoid * and + inside it.

CASE_INSENSITIVE ((?i), ASCII only unless UNICODE_CASE), MULTILINE ((?m), ^/$ per line), DOTALL ((?s)), COMMENTS ((?x)), UNICODE_CASE ((?u)), LITERAL, UNICODE_CHARACTER_CLASS ((?U), makes \w, \d, \b Unicode aware).

• By default \w is [a-zA-Z_0-9] and \d is [0-9], so é does not match \w.
• Use \p{L} or \p{IsAlphabetic} for letters in any script.
• Flags combine with |.

Backslash is an escape in Java string literals and again in the regex syntax. \d in regex must be written "\\d"; a literal backslash in regex is "\\\\".

• Text blocks do not remove this need (the escape is still processed) but are readable with \\d.
• Pattern.quote(s) wraps text in \Q...\E to match it literally.
• Matcher.quoteReplacement is for the replacement side.

Java's regex engine is a backtracking NFA. A pattern with nested or overlapping quantifiers can take exponential time on a crafted non-matching input; used on user data that is a Regular Expression Denial of Service.

• Classic: (a+)+$ on "aaaaaaaaaaaaaaaaaaaaaaaa!". Others: (a|aa)+, (.*a){20}, ^(\w+\s?)*$.
• Mitigations: avoid nested quantifiers, make alternatives disjoint, use possessive quantifiers or atomic groups, bound input length, avoid user-supplied patterns.
• Java 9+ added optimizations (e.g. memoization for some loops in 9+; more in later releases) but they are not a guarantee.
• Use a timeout wrapper (a CharSequence that checks a deadline) or a linear-time engine such as RE2/J for untrusted patterns.

java.util.regex has no built-in timeout. Wrap the input in a CharSequence whose charAt checks a deadline and throws.

class Deadline implements CharSequence {
    private final CharSequence s; private final long end;
    Deadline(CharSequence s, long endNanos) { this.s = s; this.end = endNanos; }
    public char charAt(int i) {
        if (System.nanoTime() > end) throw new IllegalStateException("regex timeout");
        return s.charAt(i);
    }
    public int length() { return s.length(); }
    public CharSequence subSequence(int a, int b) { return new Deadline(s.subSequence(a, b), end); }
    public String toString() { return s.toString(); }
}

• Simpler alternatives: run in an executor with Future.get(timeout) (the thread keeps running though), or limit input length.

find() advances through successive matches; start(), end(), group() describe the current one. results() (Java 9) returns a Stream<MatchResult>; replaceAll(Function<MatchResult,String>) (Java 9) computes replacements.

Pattern p = Pattern.compile("\\d+");
String out = p.matcher("a1 b22").replaceAll(r -> "<" + r.group() + ">");
System.out.println(out); // a<1> b<22>

• appendReplacement/appendTail with StringBuilder overloads exist since Java 9.
• reset() reuses the matcher on new input.

Pattern.asPredicate() (find semantics) and asMatchPredicate() (Java 11, full match) produce predicates; splitAsStream splits lazily.

Pattern p = Pattern.compile("^[A-Z]{2}\\d+$");
List<String> ok = ids.stream().filter(p.asMatchPredicate()).toList();

• asPredicate uses find(), so it succeeds on partial matches.

Strings dominate heap in most services. Reduce allocation, copying and retention.

• Precompile regexes; avoid split/replaceAll/matches in loops.
• Presize StringBuilder; avoid += in loops.
• Avoid substring of large inputs kept long-term in Java 6 (shared array); since 7u6 substring copies, so the parent can be freed.
• Prefer char-based indexOf/startsWith over regex for simple checks.
• Consider G1 string deduplication and compact strings for memory.
• Avoid intern() on unbounded data.

String.join(delimiter, elements) (Java 8) concatenates an Iterable<CharSequence> or varargs. Collectors.joining(delim, prefix, suffix) does the same for streams, using a StringJoiner.

• StringJoiner supports setEmptyValue.
• null elements print as "null".
• Joining does not escape the delimiter in the elements.

compareTo compares UTF-16 code units lexicographically; the result is the difference of the first differing chars or of the lengths. It is not locale-aware, so uppercase sorts before lowercase and accented letters sort after z.

• String.CASE_INSENSITIVE_ORDER compares case-folded chars.
• Use java.text.Collator.getInstance(locale) for human-correct ordering.
• Sort with Comparator.comparing(String::toLowerCase) only for simple cases.

Case mapping is locale-sensitive. In Turkish, "I".toLowerCase() becomes dotless ı, breaking comparisons such as "TITLE".toLowerCase().equals("title").

• Use toLowerCase(Locale.ROOT) or Locale.ENGLISH for protocol keywords, identifiers and map keys.
• Length can change: "ß".toUpperCase() is "SS".
• equalsIgnoreCase is locale-independent (per char), preferred for simple comparisons.

CharSequence is the read-only interface (length, charAt, subSequence, toString, chars, isEmpty since 15) implemented by String, StringBuilder, StringBuffer, CharBuffer.

• Accept CharSequence in utility methods to avoid forced toString() copies.
• Regex Pattern.matcher(CharSequence) works on any of them.
• Mutable implementations must not be used as map keys.

toCharArray() copies the characters; new String(chars) copies them back; bytes require a charset.

• s.getBytes(StandardCharsets.UTF_8) and new String(bytes, StandardCharsets.UTF_8).
• String.valueOf(char[]) equals new String(char[]); String.valueOf((Object) null) gives "null".
• s.chars() yields an IntStream of UTF-16 units; s.codePoints() yields code points.

java.util.Base64 (Java 8) converts bytes to ASCII text; it is an encoding, not encryption. Variants: basic, URL-safe (- and _, no + and /) and MIME.

String enc = Base64.getEncoder().encodeToString("hi".getBytes(StandardCharsets.UTF_8));
byte[] raw = Base64.getDecoder().decode(enc);

• Output is about 33% larger; padding = can be dropped with withoutPadding().
• Always go through bytes and an explicit charset for text.

append is amortized O(1); insert and delete shift the tail, O(n); reverse is in-place and surrogate-pair aware; setCharAt replaces one unit.

• sb.append(char) vs sb.append(int): append('a' + 1) appends the number 98 because the expression is int.
• sb.insert(0, x) repeatedly is O(n^2); use ArrayDeque or build in reverse.
• Methods return this, enabling chaining.

StringTokenizer is a legacy class (no regex, skips empty tokens, discouraged by its own Javadoc). Scanner parses typed tokens from a source using regex delimiters, slower but convenient.

• Prefer String.split or Pattern.splitAsStream for splitting.
• Scanner default delimiter is whitespace; nextInt followed by nextLine leaves the newline unread.
• For large inputs use BufferedReader and manual parsing.

String.equals returns at the first mismatch, so response time can reveal how many leading characters are correct. Use MessageDigest.isEqual(a, b) (constant-time since Java 6u17) on byte arrays.

• Compare hashes or HMACs rather than raw secrets.
• Do not log secrets; override toString of credential objects to mask.
• char[] plus Arrays.fill for short lifetime; avoid String for keys.

Never concatenate untrusted input into an interpreter's language. Use parameters (PreparedStatement), allow-lists, and context-specific encoders.

• SQL: ? placeholders; identifiers cannot be bound, so allow-list them.
• Logs: strip or encode CR/LF to avoid log forging; parameterized logging does not sanitize newlines.
• Shell: pass argument arrays to ProcessBuilder, never a joined command string.
• Regex: Pattern.quote for user text used inside a pattern.

Strings are UTF-16 in memory but must be encoded at every boundary. A mismatch between layers corrupts data.

• MySQL utf8 is only 3 bytes; use utf8mb4 for emoji (4 bytes, a surrogate pair in Java).
• Size limits (VARCHAR(255)) count chars in the DB but length() counts UTF-16 units; emoji count as 2 in Java and 1 in the DB.
• HTTP: set Content-Type: ...; charset=UTF-8; Spring defaults to UTF-8 for JSON.
• Lone surrogates cannot be encoded in UTF-8 and become ?/U+FFFD.

All turn values into strings. String.valueOf(Object) returns "null" for a null reference; obj.toString() throws NPE; "" + obj also yields "null".

• Integer.toString(i) and String.valueOf(i) are equivalent; "" + i compiles to concat machinery.
• Objects.toString(o, "default") supplies a fallback.
• For char[], String.valueOf(char[]) copies content.

A String object has a 12-16 byte header plus value reference, hash, coder, hashIsZero fields (about 24 bytes), plus a separate byte[] (16-byte header plus data). A 10-char Latin-1 string takes about 24 + 32 bytes.

• G1/Shenandoah/ZGC support -XX:+UseStringDeduplication, which merges identical byte[] of live strings in the background.
• Dedup helps with many repeated long values; it does not help short-lived strings.
• Measure with a heap histogram (jcmd GC.class_histogram) before tuning.

Records generate toString as Name[field=value, ...]. Enum name() is the identifier and toString() defaults to it; Enum.valueOf is case-sensitive and throws IllegalArgumentException for unknown names.

• Do not use toString() for persistence or protocols; its format is not a contract.
• Optional.toString() gives Optional[x] or Optional.empty.
• Override toString in enums for display only; keep name() for storage.

Each class file has a constant pool of CONSTANT_String entries pointing to UTF-8 (modified) entries. On first resolution of an ldc instruction the JVM interns that string and caches the reference in the runtime constant pool.

• Literal length in a class file is limited to 65535 bytes of modified UTF-8, so very long literals do not compile.
• Modified UTF-8 encodes U+0000 as two bytes and supplementary characters as surrogate pairs of 3 bytes each.
• This is why two classes using "x" get the same instance.

Prints a. Both calls return new strings that are discarded; s still references the original.

• Fix: s = s.concat("b").toUpperCase();.
• IDEs flag this as "result of method call ignored".

true, false, true, true. "hel" + "lo" is a compile-time constant folded into the pooled "hello"; new String always allocates; intern() returns the pooled instance.

false then true. a is not a constant variable, so the concatenation happens at runtime and creates a new object; intern() yields the pooled literal.

195c, cab, 33, 123. + is evaluated left to right: two chars (or ints) add numerically until a String operand appears.

98, b, b, c. c + 1 promotes to int; compound assignment and ++ include an implicit narrowing cast.

Prints BC and capacity 65. The char 'A' widens to int 65 and selects the StringBuilder(int capacity) constructor, so the builder starts empty with capacity 65 and the A never appears.

• Use new StringBuilder("A") or String.valueOf('A').

0, 3, 3. . matches any char so every element is empty and trailing empties are removed. "|" is an empty alternation matching between every char, giving [a, |, b].

2, 4, 1, 0. Default limit removes trailing empties; an empty input yields one element [""] because no match was found; "," produces two empty strings, both trailing and removed.

Throws NullPointerException at the switch (via s.hashCode()). The default does not catch null.

• Java 21 allows case null (or case null, default) in pattern-style switches.
• Otherwise guard: if (s == null) ....

Output is Hello, newline, then World! and a final newline. Indentation of 4 spaces is stripped; \ at the end of the World line joins it with the next line, whose own indentation was already stripped.

6, 2, 3. trim only removes chars <= U+0020, so the em space stays (total 6: em space, space, h, i, space, em space). strip removes Unicode whitespace. The non-breaking space is not "whitespace" per Character.isWhitespace, so it remains.

4, 3, b😀a, and the last line does not compile. '😀' is not a valid char literal because it needs two UTF-16 units. StringBuilder.reverse() keeps surrogate pairs intact.

• Replace the last line with s.codePointAt(1) == 0x1F600.

6, 5, 12, h?llo. UTF-8 uses 2 bytes for é; Latin-1 uses 1 each; UTF_16 adds a 2-byte BOM then 2 per char (2 + 10); ASCII cannot encode é and writes ?.

Throws IllegalFormatConversionException: d != java.lang.String at runtime. Format strings are not checked at compile time (some static analyzers do).

• String.format("%s items", 5) works since %s accepts any object.
• Too few arguments throw MissingFormatArgumentException; extra arguments are ignored.

  3.1|42   |00042
1,234,567 ff -0003.50
b a

Grouping separator and decimal mark assume an English-like default locale; others (e.g. de) print 1.234.567 and -0003,50.

xxxxx, axbxc, a11b. replaceAll treats . as any char and $0 as the whole match.

<b>x</b><b>y</b> and <b>x</b>. Greedy .* runs to the end then backtracks to the last </b>; lazy stops at the first.

• Alternative without laziness: <b>[^<]*</b>.
• Do not parse HTML with regex beyond trivial extraction.

false, false, true. matches needs the whole input; lookingAt needs a prefix match; find scans. The failed matches and lookingAt calls do not move the search position, so find starts at index 0.

4, bc, c, null. Groups are numbered by opening parenthesis; group 4 is optional and did not participate, so it returns null (while groupCount counts it).

IllegalStateException: No match found. find() returned false and the result was ignored.

• Always test: if (m.find()) { ... }.

Take 3-5 thread dumps (jcmd <pid> Thread.print); threads stuck in java.util.regex.Pattern$...match frames, often Pattern$Loop or Branch, point to ReDoS. The stack's caller shows which pattern and input.

• Reproduce with the offending input; time with increasing length (exponential growth confirms).
• Fix the pattern: remove nested quantifiers ((\w+\s?)*), use possessive quantifiers or atomic groups, or tighten classes.
• Add input length limits before matching and a deadline CharSequence.
• Consider replacing with a parser or RE2/J for untrusted patterns.

It returns false but only after exponential backtracking (2^n ways to partition the as between inner and outer +). With 30 characters it can take seconds to minutes on older JDKs.

• Safe rewrite: ^a+$.
• Or prevent backtracking: ^(?>a+)+$ or ^(a++)++$.
• Modern JDKs memoize some constructs, but you cannot rely on it.

false then true. CASE_INSENSITIVE is ASCII-only unless UNICODE_CASE is also set.

false, true, true. By default \w is ASCII [a-zA-Z_0-9]; (?U) enables Unicode semantics; \p{L} is the Unicode letter category.

With default locale tr, "TITLE".toLowerCase() gives "tıtle" (dotless i), so the key is not found.

• Always use toLowerCase(Locale.ROOT) / toUpperCase(Locale.ROOT) for identifiers, headers, enum lookups, and map keys.
• The reverse bug exists: "title".toUpperCase() in Turkish yields TİTLE.

The password was held in a String (immutable, lives until GC, may be interned or logged by toString) or inside a DTO whose toString() printed it.

• Use char[] or byte[] for secrets that you control and zero them in finally.
• Exclude secrets from toString, Lombok @ToString.Exclude, and logging filters; mask in request logging.
• Disable heap dumps with secrets or encrypt them; restrict /actuator/heapdump.
• Hash with bcrypt/Argon2 and discard the plaintext immediately.

Each iteration allocates a new string and copies all previous content, giving O(n^2) copying and heavy GC. JIT does not turn this loop into a single builder.

• Use StringBuilder (presized) or String.join("\n", lines) / Collectors.joining.
• A single expression a + b + c is fine; the problem is accumulation across iterations.

intern() puts every distinct string into the global table. Unbounded unique values (UUIDs, session IDs) fill it; entries are collectable only when unreachable and the table needs cleanup passes, so it adds GC and lookup cost without any sharing benefit.

• Intern only a small closed set of repeated values.
• Check with -XX:+PrintStringTableStatistics (Java 8) or jcmd VM.stringtable.
• A bounded ConcurrentHashMap cache or enums fit better.

Each method is synchronized, but the check-then-act sequence is not atomic, so init; can be appended twice. Interleaved multi-step appends also mix content.

• Synchronize the whole compound action on an external lock, or build per-thread StringBuilders and merge.
• StringBuffer is rarely the right tool; it only guards individual calls.

Prints 4, not 3: the comma inside the quoted field is also a separator, giving 1, "Doe, Jane", NY. Quoted fields, escaped quotes and embedded newlines need a real parser (Apache Commons CSV, OpenCSV, Jackson CSV).

• split(",", -1) at least preserves trailing empty columns.
• Never hand-roll CSV for external input.

If username is bob\nINFO login ok for admin, the attacker adds a fake log line. Parameterized logging does not strip newlines by itself.

• Sanitize CR/LF (replace with _) or use a JSON log encoder that escapes control characters.
• Cap the length of logged user input.
• Prefer log.info("login failed for {}", username) for performance, plus the encoder for safety.

In Java 6 substring shared the parent's char[], so id kept 50 MB alive. Since Java 7u6 it copies just the range, so the parent is collectable and the leak is gone.

• On modern JDKs substring costs O(length of the result).
• Old advice new String(s.substring(...)) is obsolete.

[10, 9, A, B, a, b]. Natural order is by UTF-16 code unit: digits (48-57) before uppercase (65-90) before lowercase (97-122); "10" precedes "9" since '1' < '9'.

• For case-insensitive order use String.CASE_INSENSITIVE_ORDER; for language-correct order use Collator.
• For numeric order parse to numbers or use a natural-order comparator.

a ax. References are passed by value; s += "x" rebinds the local parameter to a new string, while sb.append mutates the shared object.

nulla, 4, then NullPointerException. Concatenation converts a null reference to "null"; valueOf((Object) null) also returns "null" (length 4); invoking a method on null throws.

hi, then something like [C@1b6d3586, then hi. PrintStream.println(char[]) prints characters; concatenation uses Object.toString() (type, @, hash).

• This is why logging a password char[] with "" + pw leaks nothing useful but still signals a bug; always handle explicitly.

3, 3, 3. lines() handles \n, \r, \r\n and drops the trailing terminator. split("\n") yields a, b\r, c (note the leftover \r). \R matches any linebreak sequence.

true, true, then StringIndexOutOfBoundsException (begin 4, length 3). beginIndex == length is allowed and yields the empty string.

ba, bb, -a-b-c-. Matching scans left to right without overlap; replacing an empty target inserts the replacement between every char and at both ends.

0, 3, true, -1. The empty string is found at index 0 (and at length for lastIndexOf); an out-of-range start index is not an error for indexOf.

2, [h, e, l, l, o], h-e-l-l-o. chars() is an IntStream; casting to char is required to get characters instead of numbers (mapToObj(c -> c) would produce integers).

5, then NumberFormatException: For input string: " 5". A leading + or - is accepted; whitespace is not, so strip() before parsing.

• Integer.parseInt("") and null both throw NumberFormatException.
• Use Integer.valueOf for boxed values, and Integer.parseInt(s, radix) for other bases.

false, true, then NullPointerException. Put the known non-null literal on the left, or use Objects.equals.

false 1 2. They are canonically equivalent but different code unit sequences. Normalize before comparing or indexing: Normalizer.normalize(s, Normalizer.Form.NFC).

Normalizer.normalize(b, Normalizer.Form.NFC).equals(a); // true

• Apply normalization on input boundaries (usernames, search keys).
• Use Collator with Collator.CANONICAL_DECOMPOSITION for comparison respecting locale.

0.30000000000000004, 0.13, 0.3. Binary floating point cannot represent 0.1 or 0.2 exactly; Double.toString prints the shortest string that round-trips. %f rounds HALF_UP on the decimal value of the double (0.125 and 0.25 are exact), unlike BigDecimal's HALF_EVEN defaults elsewhere.

• Use BigDecimal (constructed from strings) for money.

String.matches compiles the regex on every call. Hoist the Pattern into a static final field and create a Matcher per call (or use asMatchPredicate()).

private static final Pattern ID = Pattern.compile("[A-Z]{3}-\\d{4}");
boolean valid(String s) { return ID.matcher(s).matches(); }

• For trivial checks (prefix, one char) skip regex: startsWith, indexOf, a loop.

A complete RFC 5322 regex is huge and still not proof that a mailbox exists. Use a simple sanity check and verify by sending a confirmation link.

• A pragmatic pattern: ^[^@\s]+@[^@\s]+\.[^@\s]+$, length-bounded (254 total, 64 for local part).
• Bean Validation @Email is lenient; Hibernate Validator accepts a@b.
• Normalize with strip() and lowercase the domain only.
• Beware nested quantifiers in copy-pasted "perfect" regexes (ReDoS).

For fixed-format lines, a precompiled regex with named groups is clear and fast enough; for very high volume or strict structure, manual indexOf/substring parsing is faster.

Pattern P = Pattern.compile(
    "(?<date>\\S+) (?<time>\\S+) (?<level>\\w+) user=(?<user>\\d+) msg=(?<msg>.*)");
Matcher m = P.matcher(line);
if (m.matches()) System.out.println(m.group("user")); // 42

• Prefer structured (JSON) logs to avoid parsing at all.
• Anchoring with matches() and specific classes (\\S+) limits backtracking.

a<2>b<44>. Omitting appendTail would lose the trailing text. The replacement string is parsed for $ and \, so computed text containing those must go through Matcher.quoteReplacement.

• The StringBuilder overloads exist since Java 9; before that only StringBuffer.
• Simpler on Java 9+: m.replaceAll(r -> String.valueOf(Integer.parseInt(r.group()) * 2)).

Java requires lookbehind to have an obvious maximum length. Unbounded + or * historically raised PatternSyntaxException: Look-behind group does not have an obvious maximum length. Newer releases accept some forms, but unbounded lookbehind is still a risk of failure and poor performance.

• Use a bounded form: (?<=a{1,10})b.
• Or capture the prefix in a group and use group(1) instead.

The comparison is always false for runtime strings from the request because they are new objects, not the pooled literal. Use "ACTIVE".equals(status).

• It can appear to work in unit tests that pass literals.
• Static analysis (SpotBugs ES_COMPARING_STRINGS_WITH_EQ, Sonar S4973) flags it.
• Better still: parse into an enum with a null-safe lookup.

Prints +/8= and then throws IllegalArgumentException: Illegal base64 character 2b. The basic alphabet uses + and /; the URL-safe alphabet uses - and _.

• Encode and decode with the same variant; Base64.getUrlEncoder().withoutPadding() for tokens.
• Remember it is encoding, not encryption.

Before Java 18 new String(byte[]) uses the platform default charset, so a UTF-8 file with é works on Linux CI (UTF-8) but turns into mojibake on Windows (Cp1252). Specify the charset.

String s = Files.readString(path, StandardCharsets.UTF_8);

• Java 18+ makes UTF-8 the default but explicit is still better.
• Files.readString throws MalformedInputException on invalid UTF-8, unlike new String.

1 null. toString() copies the content, so the key is an independent immutable string; the later builder change does not affect it, and "kx" was never stored.

• Using the StringBuilder itself as a key would be unsafe: identity hashCode/equals and mutability.

"Aa" prints first, "BB" prints second, anything else none. Both labels hash to 2112, so the generated lookupswitch falls into one bucket where equals picks the right label.

• Correctness never depends on hashes alone.
• The compiler emits two switches: one on hashCode, one on a computed index.

Strip, split on one or more whitespace characters, reverse, and join with a single space.

List<String> w = Arrays.asList(s.strip().split("\\s+"));
Collections.reverse(w);
System.out.println(String.join(" ", w)); // blue is sky the

• Without strip(), a leading separator would produce a leading empty element.
• For huge input avoid regex; scan from the end with lastIndexOf.