In addition, if $pre and $post (the two-character versions) might be changed some day, perhaps by someone that doesn't recognize/appreciate the fact that they'll be used in a regular expression and thus might not quote them, we can use the \Q and \E codes to avoid the problem altogether:

$pre  = '**';
$post = '%%';

/(\Q$pre\E.*?\Q$first\E*\Q$post\E)/
[download]