IPv4 with CIDR Notation Regex for PHP

What this pattern does

This PHP-ready regular expression precisely validates IPv4 addresses in CIDR notation, such as 192.168.1.1/32. The pattern ensures both address correctness (0-255 per octet) and prefix length validity (0-32). Incorporate this regex into any PHP project that requires reliable IP address parsing, such as input sanitization in a web form or configuring network settings within an application.

Php Implementation

<?php
// IPv4 with CIDR Notation
// ReDoS-safe | RegexVault — Web & Network > IPv4

define('IPV4_WITH_CIDR_NOTATION_PATTERN', '/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[0-9])\\/(?:3[0-2]|[12][0-9]|[0-9])$/');

function validate_ipv4_with_cidr_notation(string $input): bool {
    return (bool) preg_match(IPV4_WITH_CIDR_NOTATION_PATTERN, $input);
}

// Example
var_dump(validate_ipv4_with_cidr_notation("192.168.0.0/24")); // bool(true)

Test Cases

When to use this pattern

PHP's PCRE regex engine can be susceptible to catastrophic backtracking, a serious vulnerability when handling user-provided data. Without a ReDoS-safe pattern, a malicious actor could craft an input that consumes excessive resources, potentially leading to denial-of-service. This validated regex provides peace of mind when integrating IP address validation into frameworks like Symfony or Laravel. It's production-ready, minimizing the risk of unexpected behavior.

Common Pitfalls

Technical Notes

Prefix length alternatives: 3[0-2] covers 30–32, [12][0-9] covers 10–29, [0-9] covers 0–9. Combined this gives 0–32 exactly.