Regex escaper

Escapes every character that means something to the regular-expression engine, so a literal string — a price, a file path, a URL — can be dropped into a pattern and match itself rather than being read as syntax.

Twelve characters carry meaning inside a pattern and have to be escaped to match literally: `. * + ? ^ $ { } ( ) | [ ] \`. A forward slash and a hyphen are added here too — the slash because a pattern written between slashes needs it, the hyphen because inside a character class an unescaped one means a range. The reason this matters beyond convenience is injection. Building a pattern by concatenating user input is the regex equivalent of building SQL by concatenation: a search box that puts what someone typed straight into a `new RegExp` can be handed `(a+)+$` and made to hang the process. Escaping first removes the syntax and leaves the text. JavaScript has no built-in for this — `RegExp.escape` was proposed and only recently reached browsers — which is why almost every codebase has its own copy of the same one-line function.