There's a standard base dialect of regex that works everywhere, just like SQL.

SQL also tends to be slower than hand optimized data structure wrangling.

If you use untrusted regex, you'll be subject to DOS. If you use untrusted SQL, you'll be subject to much worse.