diff --git a/src/controllers/auth.js b/src/controllers/auth.js
index ac5bac6696..8884128111 100644
--- a/src/controllers/auth.js
+++ b/src/controllers/auth.js
@@ -173,7 +173,9 @@ api.resetPassword = function(req, res, next){
     newPassword =  utils.makeSalt(), // use a salt as the new password too (they'll change it later)
     hashed_password = utils.encryptPassword(newPassword, salt);
 
-  User.findOne({'auth.local.email':new RegExp("^"+email+"$","i")}, function(err, user){
+  // escape email for regex, then search case-insensitive. See http://stackoverflow.com/a/3561711/362790
+  var emailRegExp = new RegExp('^' + email.replace(/[-\/\\^$*+?.()|[\]{}]/g, '\\$&') + '$', 'i');
+  User.findOne({'auth.local.email':emailRegExp}, function(err, user){
     if (err) return next(err);
     if (!user) return res.send(500, {err:"Couldn't find a user registered for email " + email});
     user.auth.local.salt = salt;