Phase: Architecture and Design
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
Effectiveness: High
Phase: System Configuration
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Effectiveness: Moderate
Phase: Implementation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
Effectiveness: High
Phase: Implementation
Limit the length of the input that the regular expression will process.
Effectiveness: Moderate