The night before the story: substitution and splitting

9 p.m. The office door flies open. Reporter Oh, out of breath, flips open his laptop. "We got a tip. It's Market Jeong's customer list. The story runs tomorrow morning, but I can't print people's personal data as it is."

The director peers at the screen. It's the same member list from 3 a.m. that you found in Lesson 6. "The finding part is over. Today we change things and cut things."

id, name; phone | joined
1001,kim,010-0000-5678,20/10/2026
1002; lee; 010-0000-1234; 19/10/2026
1003 | park | 010-0000-9012 | 03/09/2026
1004, choi;010-0000-3456  |28/02/2026
# (a+)+$

There's something odd on the very last line, but Reporter Oh is racing a deadline and doesn't give it a second look.

7-1. Find and replace: re.sub (8 min)

re.sub(pattern, replacement, original) returns a new string in which every match of the pattern has been replaced. The original stays untouched, because Python strings can't be changed in place.

import re

re.sub(r"\d{4}", "****", "010-0000-5678")    # '010-****-****'

There are two runs of four digits, so the last block got hidden too. To keep the first three digits and the last four and hide only the middle, capture the parts you want to keep in groups and call them back in the replacement. \1 means "whatever group 1 captured".

re.sub(r"(\d{3})-\d{4}-(\d{4})", r"\1-****-\2", "010-0000-5678")   # '010-****-5678'

The replacement contains backslashes too, so write it as r"...", just like the pattern.

7-2. Groups inside the replacement: \g<1>, \g, \g<0> (10 min)

The dates in the list are written day/month/year, like 20/10/2026. The paper needs them as 2026-10-20. All it takes is putting the groups back in a different order.

re.sub(r"(\d\d)/(\d\d)/(\d{4})", r"\3-\2-\1", "20/10/2026")            # '2026-10-20'
re.sub(r"(\d\d)/(\d\d)/(\d{4})", r"\g<3>-\g<2>-\g<1>", "20/10/2026")   # '2026-10-20'

\3 and \g<3> mean the same thing. The named groups from Lesson 6 are called with \g<name>. You don't have to remember the order, so there's less room for mistakes.

re.sub(r"(?P<d>\d\d)/(?P<m>\d\d)/(?P<y>\d{4})", r"\g<y>-\g<m>-\g<d>", "20/10/2026")   # '2026-10-20'

\g<0> is the whole match. Use it when you want to wrap what you found instead of removing it.

re.sub(r"\d{3}-\d{4}-\d{4}", r"[\g<0>]", "1001,kim,010-0000-5678")   # '1001,kim,[010-0000-5678]'

Be careful when you want a digit right after a group number. \10 doesn't mean "group 1 followed by 0"; it means group 10. In that case, close off the number with angle brackets: \g<1>0.

re.sub(r"(\d+)", r"\g<1>0", "kim 5")   # 'kim 50'
re.sub(r"(\d+)", r"\10", "kim 5")      # re.PatternError: invalid group reference 10 at position 1

In the replacement, \n still becomes a newline character. An escaped letter with no meaning, like \q, is an error.

re.sub(r",", r"\n", "a,b")    # 'a\nb'
re.sub(r",", r"\q", "a,b")    # re.PatternError: bad escape \q at position 0

re.PatternError is the name used since Python 3.13; it's the same exception as the old name re.error. We'll look at it closely in Lesson 12.

7-3. Replacing with a function, plus count and subn (8 min)

Instead of a replacement string, you can pass a function. Each time re.sub finds a match, it hands that Match object to your function and replaces the match with whatever string the function returns. Let's keep only the first letter of each name and put an asterisk for every other letter. A fixed template can't do that.

def hide(m):
    name = m.group(1)
    return "," + name[0] + "*" * (len(name) - 1) + ","

re.sub(r",([a-z]+),", hide, "1003,park,010-0000-9012,03/09/2026")   # '1003,p***,010-0000-9012,03/09/2026'
re.sub(r"[a-z]+", lambda m: m[0].upper(), "kim and lee")             # 'KIM AND LEE'

• The function takes one Match and must return a string. Returning a number gives you a TypeError.
• The Evidence lab can't run function replacements. Try them in Python yourself.

count sets how many spots to replace, counting from the start. The default, 0, means "all of them". re.subn returns a tuple of the new string and the number of replacements. Say the list at the top is stored in a string called leak.

re.sub(r"\d{3}-\d{4}-\d{4}", "***", leak, count=1).splitlines()[1:3]
# ['1001,kim,***,20/10/2026', '1002; lee; 010-0000-1234; 19/10/2026']

re.subn(r"\d{3}-\d{4}-\d{4}", "***", leak)[1]   # 4

Now the article can state the exact number: "four phone numbers were redacted".

7-4. Cutting: re.split (9 min)

Each line of the list uses different separators. Commas, semicolons and vertical bars are all mixed together, with random spaces around them. str.split only takes a single separator. re.split cuts on a pattern.

re.split(r"\s*[,;|]\s*", "a, b;c  |d")               # ['a', 'b', 'c', 'd']
re.split(r"\s*[,;|]\s*", "a, b;c  |d", maxsplit=2)   # ['a', 'b', 'c  |d']

• The \s* on each side of the separator swallows the spaces as part of the separator, so the columns come out clean.
• maxsplit=2 cuts at most twice and leaves the rest as it is in the last column.

If the pattern has a capturing group, the separators it cut on are slotted into the result list as well. That's handy when you need to record which separator was used. If you don't need them, use (?:...).

re.split(r"\s*([,;|])\s*", "a, b;c  |d")   # ['a', ',', 'b', ';', 'c', '|', 'd']

You can even cut on empty matches that take up no characters. \b only matches at word boundaries, so the string is cut between every word and space. There are boundaries at both ends too, which produces empty strings.

re.split(r"\b", "a b")   # ['', 'a', ' ', 'b', '']

7-5. Pass count, maxsplit and flags by name (5 min)

The fourth positional slot of re.sub is count. If you absent-mindedly put re.I fourth to add a flag, it goes in as a count, not a flag, because the actual value of re.I is 2.

re.sub("a", "b", "aAaA", re.I)         # 'bAbA'  ← case isn't ignored; only two get replaced
re.sub("a", "b", "aAaA", flags=re.I)   # 'bbbb'

This mistake is so common that, starting with Python 3.13, passing count, maxsplit or flags as positional arguments raises a DeprecationWarning. The first line above warns 'count' is passed as positional argument. The same goes for maxsplit and flags in re.split. Always name them: count=1, maxsplit=2, flags=re.I.

Cracking the case (10 min)

Chain the steps: hide, fix the dates, then cut. Skip the header and the last line, and cut only the customer rows.

masked = re.sub(r"(\d{3})-\d{4}-(\d{4})", r"\1-****-\2", leak)
fixed = re.sub(r"(?P<d>\d\d)/(?P<m>\d\d)/(?P<y>\d{4})", r"\g<y>-\g<m>-\g<d>", masked)

for row in fixed.splitlines()[1:-1]:
    print(re.split(r"\s*[,;|]\s*", row))
# ['1001', 'kim', '010-****-5678', '2026-10-20']
# ['1002', 'lee', '010-****-1234', '2026-10-19']
# ['1003', 'park', '010-****-9012', '2026-09-03']
# ['1004', 'choi', '010-****-3456', '2026-02-28']

Reporter Oh takes the table and starts to get up, but the director raises a hand. "Wait. The last line."

print(fixed.splitlines()[-1])   # # (a+)+$

That's not list data. It's a regex someone left there on purpose. To search for these exact characters, you have to switch off every metacharacter, one by one, as you learned in Lesson 1.

print(re.escape("(a+)+$"))          # \(a\+\)\+\$
re.search(r"\(a\+\)\+\$", leak)     # <re.Match object; span=(177, 183), match='(a+)+$'>

"What is that?" Reporter Oh asks. The director is silent for a long moment before she answers. "A backtracking trap. Any regex engine that reads this goes back over the same paths countless times until it grinds to a halt. Keep it out of tomorrow's story."

After Reporter Oh leaves, the director takes a faded photo frame out of her drawer. It's a picture from the agency's first year. She stares at it for a long time, then lays it face down on the desk.

Exercises

1. Rewrite the member IDs 1001 to 1004 with a # in front, like #1001. With \g<0> it takes a single line.
2. Predict the result of re.split(r"(\s*)([,;|])(\s*)", "a, b"). With three groups, how many extra items get slotted in?
3. Use a function replacement to double every number in "price 1500 and 300". Don't forget that the function has to return a string.