Ruben Cardenal wrote: > Hi, > > Loren answered that a month ago. Is in the archives. You may use: > > header RULE_NAME ALL =~ /\nTo: ([EMAIL PROTECTED]).+\nSubject:\s*Fw: > .{0,30}\s*\1\b/i > > That covers "Fw: userid" and "Fw: (some word[s]) userid". >
True, but that's using () and \1, which is exactly what Jonathan said he did not want to use. So you can do it that way, but you'll suffer the performance penalty of a multi-line regex with backreferences. The only *efficient* way to do it is to write a plugin.