So I should have said.

No, that's insanely complex for a static pattern.

Also, I prefer to put the anchors in the parent regexp. It makes more sense conceptually, the code pattern work in more situations, and you don't have to add (?:) since qr// adds one for you.

I'm not sure what you mean when you say I don't convert the keys to regexp.

Injection bug. See the addition of quotemeta in the last two snippets.