On Mon, 2003-12-15 at 18:46, Ken Anderson wrote: >Seeing a false positive from a weatherbug spam using this re. > > /%([01][0-9a-f]|7f).*@/i Hmmm, perhaps.... /%^[^?]*([01][0-9a-f]|7f).*@/i If my brains working right this will only match if the %01 comes before the first ? (which marks the end of the address part of the URL)