In JavaScript, what does String.prototype.replace do when you pass a plain string as the pattern, and how do replaceAll and a global regex differ from it?

## What replace actually is `String.prototype.replace(pattern, replacement)` takes a pattern (a string or a `RegExp`) and a replacement (a string or a function) and **returns a new string**. It never modifies the receiver, because JavaScript strings are immutable values — if you ignore the return value, nothing appears to happen: ```js const s = 'a-b-c'; s.replace('-', '+'); console.log(s); // 'a-b-c' — unchanged console.log(s.replace('-', '+')); // 'a+b-c' ``` ## A string pattern replaces exactly one occurrence When `pattern` is a plain string, `replace` finds the **first** occurrence and substitutes it. There is no "all" option and no third argument — `s.replace('-', '+', 'g')` silently ignores the extra argument and still replaces one. This is the single most common beginner bug with the method, and it is easy to miss because the code looks right and works on inputs that happen to contain one match. ## The global flag makes it repeat If the pattern is a `RegExp` carrying the `g` flag, `replace` walks the whole string and substitutes every non-overlapping match, left to right: ```js 'a-b-c'.replace(/-/g, '+'); // 'a+b+c' 'a-b-c'.replace(/-/, '+'); // 'a+b-c' ``` Under the hood, `replace` delegates to the pattern's `Symbol.replace` method when the pattern has one, which is how `RegExp` customises the operation. That implementation sets the regex's `lastIndex` to 0 before it starts when the regex is global, so a shared global regex does not make `replace` skip matches the way it can make `test` and `exec` behave oddly. ## replaceAll (ES2021) `replaceAll` gives you "every occurrence" without a regex: ```js '1.2.3'.replaceAll('.', '-'); // '1-2-3' '1.2.3'.replace(/./g, '-'); // '-----' — `.` is "any character" ``` That second line is the reason `replaceAll` was added. Before it existed, replacing every occurrence of a *variable* substring meant constructing a regex from that string and escaping every character that means something special in a pattern; forget the escaping and the substitution quietly does the wrong thing, as `.` does above. `replaceAll` with a string pattern compares literally, so no escaping question arises. `replaceAll` also accepts a `RegExp`, but only a global one. Passing a non-global regex throws: ```js 'aaa'.replaceAll(/a/, 'b'); // TypeError: replaceAll must be called with a global RegExp ``` The guard exists because the two halves of the call would contradict each other, and a silent choice between them would be a bug factory. ## The replacement string is not taken literally Both methods expand `$` sequences in a replacement **string**: `$$` inserts a literal `$`, `$&` the matched substring, `` $` `` the text before the match, `$'` the text after it, `$1`…`$n` the numbered captures, and `$<name>` a named capture. So a replacement value that came from user input or from a password generator can inject text you never intended: ```js 'price'.replace('price', "$&$&"); // 'priceprice' ``` Two safe routes: double every `$` in the untrusted value (`value.replaceAll('$', '$$$$')`), or pass a **function** as the replacement — its return value is used verbatim, with no `$` expansion at all. ## Choosing between them - Replacing one known occurrence, or you genuinely want only the first: `replace` with a string. - Replacing every occurrence of a literal substring, especially one held in a variable: `replaceAll` with a string. - The pattern is a real pattern (classes, quantifiers, alternation): a regex — add `g` when you want all of them. - The replacement depends on what matched: a replacer function, with either method. ## Availability `replace` has been in the language since ES3. `replaceAll` is ES2021 — universally available in current browsers and Node, but it is the one to check if you target a very old runtime; the fallback is `split(sep).join(rep)` for a literal separator or an escaped global regex.