An input mask can be used to constrain the input the user can give, this is constrained at the moment the user enters data into the system. So if the input mask is '9999', the user is not allowed to type in letters or special characters; only numbers will be accepted.

Regular expressions also give you control over what the user can give as input. There are two main differences between regular expressions and input mask

• With regular expressions it is possible to make more complex validations; with an input mask it is not possible to have variable elements in your constrain. So a regular expression can be used to check if the input form an email adress is 'anything@anything.anything', which is not possible with input masks, as all the positions are fixed.
• Regular expressions are checked before commit (where input masks constrain the input of the user 'real time'). If the input is not compliant with the regular expression, then the commit will be blocked and an errormessage will appear.

More info on how to use regular expressions can be found here

A regular expression defines a validation on an attribute. This validation rule is checked at the server when an object is committed.

An inputmask is set on a textbox on a form. It forces the user to add input in a predefined format. So, inputmasks are enforced in the client.