TL;DR
Use [.] instead of . and [0-9] instead of d to avoid escaping issues in some languages (like Java).
Thanks to the nameless one for originally recognizing this.
One relatively simple pattern for matching a floating point number is
[+-]?([0-9]*[.])?[0-9]+
This will match:
See a working example
If you also want to match 123. (a period with no decimal part), then you'll need a slightly longer expression:
[+-]?([0-9]+([.][0-9]*)?|[.][0-9]+)
See pkeller's answer for a fuller explanation of this pattern
If you want to include a wider spectrum of numbers, including scientific notation and non-decimal numbers such as hex and octal, see my answer to How do I identify if a string is a number?.
If you want to validate that an input is a number (rather than finding a number within the input), then you should surround the pattern with ^ and $, like so:
^[+-]?([0-9]+([.][0-9]*)?|[.][0-9]+)$
Irregular Regular Expressions
"Regular expressions", as implemented in most modern languages, APIs, frameworks, libraries, etc., are based on a concept developed in formal language theory. However, software engineers have added many extensions that take these implementations far beyond the formal definition. So, while most regular expression engines resemble one another, there is actually no standard. For this reason, a lot depends on what language, API, framework or library you are using.
(Incidentally, to help reduce confusion, many have taken to using "regex" or "regexp" to describe these enhanced matching languages. See Is a Regex the Same as a Regular Expression? at RexEgg.com for more information.)
That said, most regex engines (actually, all of them, as far as I know) would accept .. Most likely, there's an issue with escaping.
The Trouble with Escaping
Some languages have built-in support for regexes, such as JavaScript. For those languages that don't, escaping can be a problem.
This is because you are basically coding in a language within a language. Java, for example, uses
// creates a single character string: ""
String x = "\";
However, regexes also use the
// Creates a two-character string: "\"
// When used as a regex pattern, will match a single character: ""
String regexPattern = "\\";
In your case, you have probably not escaped the backslash character in the language you are programming in:
// will most likely result in an "Illegal escape character" error
String wrongPattern = ".";
// will result in the string "."
String correctPattern = "\.";
All this escaping can get very confusing. If the language you are working with supports raw strings, then you should use those to cut down on the number of backslashes, but not all languages do (most notably: Java). Fortunately, there's an alternative that will work some of the time:
String correctPattern = "[.]";
For a regex engine, . and [.] mean exactly the same thing. Note that this doesn't work in every case, like newline (\n), open square bracket (\[) and backslash (\\ or [\]).
A Note about Matching Numbers
(Hint: It's harder than you think)
Matching a number is one of those things you'd think is quite easy with regex, but it's actually pretty tricky. Let's take a look at your approach, piece by piece:
[-+]?
Match an optional - or +
[0-9]*
Match 0 or more sequential digits
.?
Match an optional .
[0-9]*
Match 0 or more sequential digits
First, we can clean up this expression a bit by using a character class shorthand for the digits (note that this is also susceptible to the escaping issue mentioned above):
[0-9] = d
I'm going to use d below, but keep in mind that it means the same thing as [0-9]. (Well, actually, in some engines d will match digits from all scripts, so it'll match more than [0-9] will, but that's probably not significant in your case.)
Now, if you look at this carefully, you'll realize that every single part of your pattern is optional. This pattern can match a 0-length string; a string composed only of + or -; or, a string composed only of a .. This is probably not what you've intended.
To fix this, it's helpful to start by "anchoring" your regex with the bare-minimum required string, probably a single digit:
d+
Now we want to add the decimal part, but it doesn't go where you think it might:
d+.?d* /* This isn't quite correct. */
This will still match values like 123.. Worse, it's got a tinge of evil about it. The period is optional, meaning that you've got two repeated classes side-by-side (d+ and d*). This can actually be dangerous if used in just the wrong way, opening your system up to DoS attacks.
To fix this, rather than treating the period as optional, we need to treat it as required (to separate the repeated character classes) and instead make the entire decimal portion optional:
d+(.d+)? /* Better. But... */
This is looking better now. We require a period between the first sequence of digits and the second, but there's a fatal flaw: we can't match .123 because a leading digit is now required.
This is actually pretty easy to fix. Instead of making the "decimal" portion of the number optional, we need to look at it as a sequence of characters: 1 or more numbers that may be prefixed by a . that may be prefixed by 0 or more numbers:
(d*.)?d+
Now we just add the sign:
[+-]?(d*.)?d+
Of course, those slashes are pretty annoying in Java, so we can substitute in our long-form character classes:
[+-]?([0-9]*[.])?[0-9]+
Matching versus Validating
This has come up in the comments a couple times, so I'm adding an addendum on matching versus validating.
The goal of matching is to find some content within the input (the "needle in a haystack"). The goal of validating is to ensure that the input is in an expected format.
Regexes, by their nature, only match text. Given some input, they will either find some matching text or they will not. However, by "snapping" an expression to the beginning and ending of the input with anchor tags (^ and $), we can ensure that no match is found unless the entire input matches the expression, effectively using regexes to validate.
The regex described above ([+-]?([0-9]*[.])?[0-9]+) will match one or more numbers within a target string. So given the input:
apple 1.34 pear 7.98 version 1.2.3.4
The regex will match 1.34, 7.98, 1.2, .3 and .4.
To validate that a given input is a number and nothing but a number, "snap" the expression to the start and end of the input by wrapping it in anchor tags:
^[+-]?([0-9]*[.])?[0-9]+$
This will only find a match if the entire input is a floating point number, and will not find a match if the input contains additional characters. So, given the input 1.2, a match will be found, but given apple 1.2 pear no matches will be found.
Note that some regex engines have a validate, isMatch or similar function, which essentially does what I've described automatically, returning true if a match is found and false if no match is found. Also keep in mind that some engines allow you to set flags which change the definition of ^ and $, matching the beginning/end of a line rather than the beginning/end of the entire input. This is typically not the default, but be on the lookout for these flags.
