(Other big problem with regexes is that they are strictly slower than handrolling the equivalent string parsing code, and kind of a denial of service hazard to boot).
SQL also tends to be slower than hand optimized data structure wrangling.
If you use untrusted regex, you'll be subject to DOS. If you use untrusted SQL, you'll be subject to much worse.