The main issue I have with regular expressions is that the current syntax mixes "code" and "data". I.e. it's very easy to write something like /https?:\/\/www.

The main issue I have with regular expressions is that the current syntax mixes "code" and "data". I.e. it's very easy to write something like /https?:\/\/www.foo.com/ (e.g. you want to whitelist your own domain for some action) and forget that this also matches wwwxfoo.com which could be owned by anyone (it's also a common mistake to forget the anchors, in this case evil.com/?https://www.foo.com https://www.foo.com might also match). It is pretty easy to come up with a better syntax, but it's going to be hard to convince everyone to use it. As someone else commented on this thread, the current way of doing things is pretty entrenched.