Only the characters listed on this page need to be escaped in PHP regex matching/replacing.

While < and > can act as delimiter, it doesn't need to be escaped in the given example because you already have /(slash) acting as a delimiter.

Referring to the link in question

The preg_quote() function may be used to escape a string for injection into a pattern and its optional second parameter may be used to specify the delimiter to be escaped.

preg_quote() is what you are looking for:

Description

string preg_quote ( string $str [, string $delimiter = NULL ] )

preg_quote() takes str and puts a backslash in front of every character that is part of the regular expression syntax. This is useful if you have a run-time string that you need to match in some text and the string may contain special regex characters.

The special regular expression characters are: . \ + * ? [ ^ ] $ ( ) { } = ! < > | : -

Parameters

str

The input string.

delimiter

If the optional delimiter is specified, it will also be escaped. This is useful for escaping the delimiter that is required by the PCRE functions. The / is the most commonly used delimiter.

Importantly, note that if the $delimiter argument is not specified, the delimiter - the character used to enclose your regex, commonly a forward slash (/) - will not be escaped. You will usually want to pass whatever delimiter you are using with your regex as the $delimiter argument.

Example - using preg_match to find occurrences of a given URL surrounded by whitespace:

$url = 'http://stackoverflow.com/questions?sort=newest';

// preg_quote escapes the dot, question mark and equals sign in the URL (by
// default) as well as all the forward slashes (because we pass '/' as the
// $delimiter argument).
$escapedUrl = preg_quote($url, '/');

// We enclose our regex in '/' characters here - the same delimiter we passed
// to preg_quote
$regex = '/\s' . $escapedUrl . '\s/';
// $regex is now:  /\shttp\:\/\/stackoverflow\.com\/questions\?sort\=newest\s/

$haystack = "Bla bla http://stackoverflow.com/questions?sort=newest bla bla";
preg_match($regex, $haystack, $matches);

var_dump($matches);
// array(1) {
//   [0]=>
//   string(48) " http://stackoverflow.com/questions?sort=newest "
// }

You can just extract your $link string using sscanf^Docs:

$source = "javascript:window.open('http://www.google.com')";

sscanf($source, "javascript:window.open('%[^']", $link);

echo $link;

(Demo) The benefit is that the syntax is easier to understand than with regular expressions and you can assign values to variables directly.

In case you want to use regular expressions, you need to quote special characters (preg_quote^Docs) before you create your pattern. This needs more work, as you must build the regex pattern prior running it:

# bare pattern, placeholder for matching group:
$pattern = "javascript:window.open('%s')"; 

# quote the pattern, you use ' as delimiter, it needs to be quoted
$pattern = preg_quote($pattern, "'");

# build full regex with delimiters, modifiers and inserting your match group
$pattern = sprintf("'$pattern'is", '(.*?)');

# run it
preg_match($pattern, $source, $export);

Demo

This will result in the following pattern:

'javascript\:window\.open\(\'(.*?)\'\)'is

Or as a valid PHP string:

$pattern = '\'javascript\\:window\\.open\\(\\\'(.*?)\\\'\\)\'is';

or your example:

preg_match('\'javascript\\:window\\.open\\(\\\'(.*?)\\\'\\)\'is', $source, $export);

You can use the function preg_quote. It puts a backslash in front of every character that is part of the regular expression syntax. This is useful if you have a run-time string that you need to match in some text and the string may contain special regex characters.