text:
Build a nine-level word guessing game
The basics:
You'll need to provide a nine-level word guessing game in the fewest characters possible (in your language of choice).
The metrics:

Provide a word-list
(one word per line, seperated by a
newline) (e.g.
/usr/share/dict/words or similar could do). It's fine to
pipe a filename or the wordlist
itself into your solution.
Provide 9 levels with incrementing word length (words with 4 characters -> 12 characters):

Level 1:  a random word from the wordlist containing 4 characters
Level 2:  a random word from the wordlist containing 5 characters
...                                                  ...
Level 8:  a random word from the wordlist containing 11 characters
Level 9:  a random word from the wordlist containing 12 characters

In every level, obfuscate a randomly chosen word from the list (with a specific word length of course) and replace a certain number of characters by the asterisk (*). The number of characters to replace: current_word_length / 3 (round down). Randomize which characters to replace.
Let the player 'guess' the word (only one try per level), give feedback (correct or wrong) and give points accordingly. When correct, the player gains number_of_obfuscated_characters * 10 points.
Print the current score at the end of each level.

The format (& sample I/O):
Make sure you follow the following formatting scheme:

Level 1     # level header
=======     #
g*ek        # obfuscated word
geek        # user input
correct     # guess validation
score: 10   # print score
            #
Level 2
=======
l*nux
linux
correct
score: 20

Level 3
=======
ran**m
random
correct
score: 40

...

Level 9
=======
sem***act*ve
semiinactive
wrong
score: 90

Winner:
Shortest solution (by code character count). Have fun golfing!

What is the solution to sem**actve, BTW?

@JoeZ. maybe sem***act*ve ==> semelfactive

Perl, 180 chars
@w=<>;for$n(4..12){@x=grep/^.{$n}$/,@w;$_=$w=$x[rand@x];vec($_,rand$n,8)=42while($==$n/3)>y/*//;print"Level @{[$n-3]}
=======
$_";say<>eq$w?($@+=$=)&& correct:wrong,"
score: $@0
"}

Ruby beating Perl?  That will not do! :-)
Like jsvnm's Ruby solution, but unlike Joel Berger's Perl code, this script takes the filename of a word list as a command line parameter.  That is, you should run it like this:
perl -M5.010 guessword.pl /usr/share/dict/words

Here's a de-golfed version:
@w = <>;
for $n (4..12) {
    @x = grep /^.{$n}$/, @w;
    $_ = $w = $x[rand@x];
    vec($_, rand $n, 8) = 42 while ($= = $n/3) > y/\*//;
    print "Level @{[ $n-3 ]}\n=======\n$_";
    say <> eq $w ? ($@ += $=) && correct : wrong, "\nscore: $@0\n";
}

The statement vec($_, rand $n, 8) = 42 while ($= = $n/3) > y/*// contains a few interesting tricks.  First, 42 is the ASCII code of an asterisk; it turns out that using vec to modify single chars in a string is shorter than doing it with substr.  Second, the variable $= takes only integer values, so using it to store the number of hidden letters saves me an int.  Finally, y/*// is a short way to count the number of asterisks in a string using the transliteration operator.
Edit: Saved 7 chars by using $@ to store the score divided by 10 and appending a zero to it during output (which, come to think of it, would've been shorter than the previous version even if I'd used a normal variable).
Edit 2: Turns out embedding literal newlines in the output strings saves a char over messing with $,.

Ruby (188)
takes the filename to read words from as argument.
q=*$<
s=0
4.upto(12){|n|o=''+w=q.grep(/^#{?.*n}$/).sample
[*0..n-1].sample(c=n/3).map{|i|o[i]=?*}
puts"Level #{n-3}",?=*7,o
puts STDIN.gets==w ?(s+=c;"correct"):"wrong","score: #{s}0",""}

Nice one (Ruby beating Perl, that's a not a familiar event in Code Golf ;-)

In my defense I didn't try that hard. Glad Ilmari Karonen had my back.

Bash, 350 chars
S=0
for L in {4..12}
do
echo -e Level $(($L-3))\\n=======
W=$(grep -E ^.{$L}$ /usr/share/dict/words|shuf|tail -1)
G=$W
while [ `sed 's/[^*]//g'<<<$G|wc -c` -le $(($L/3)) ]
do
P=$(bc<<<$RANDOM*$L/32767)
G=$(sed "s/\(.\{$P\}\)./\1*/"<<<$G)
done
echo $G
read U
if [ x$U == x$W ]
then
echo correct
S=$(($S+$L/3*10))
else
echo wrong
fi
echo score: $S
done

No cheating! It's 371 chars according to Notepad++.

@Nyuszika7H: including 21 \r chars, isn't it? This is for Unix, where a newline is a single linefeed char.

@ninjalj: Yeah, but keep in your mind that not everyone uses the Unix line break format. We have to be fair. http://meta.codegolf.stackexchange.com/questions/167/line-break-formats-and-character-numbers

@Nyuszika7H: If you can use it, then by all means you should in a code golf. If your language has two equivalent ways of doing something and one is shorter, do you use the longer because some people might not know the shorter one? As for line breaks, if you have a languages that requires CRLF, then you're out of luck, but I'm not aware of any such language.

Can't you almost always replace newlines w/ semicolons or spaces?

@barrycarter: you can replace them, but all of them take 1 character.

@ninjalj OK, I meant that it doesn't take 2, but maybe the discussion above already says that.

Totally unrelated, but I never knew you could use <<< for input to commands, that's pretty cool.

Perl: 266
@ARGV='/usr/share/dict/words';@w=<>;$"='';while($l<9){$o=1+int++$l/3;@s=grep{$l+4==length}@w;@g=split//,$t=$s[rand$#s+1];my%r;$r{rand$#g}++while keys%r<$o;$g[$_]='*'for keys%r;print"Level $l\n=======\n@g";print<>eq$t?do{$p+=$o*10;"Correct"}:"Wrong","\nScore: $p\n"}

or with a little more white space
@ARGV='/usr/share/dict/words';
@w=<>;
$"='';
while($l<9){
  $o=1+int++$l/3;
  @s=grep{$l+4==length}@w;
  @g=split//,$t=$s[rand$#s+1];
  my%r;
  $r{rand$#g}++while keys%r<$o;
  $g[$_]='*'for keys%r;
  print"Level $l\n=======\n@g";
  print<>eq$t?do{$p+=$o*10;"Correct"}:"Wrong","\nScore: $p\n"
}

and I think with a little work it could get even better!

R, 363 chars
w=tolower(scan("/usr/share/dict/words",what="c"));l=nchar(w);score=0;for(i in 1:9){mw=sample(w[l==i+3],1);cat("Level",i,"\n=======\n",replace(strsplit(mw,"")[[1]],sample(nchar(mw),floor(nchar(mw)/3)),"*"),"\n");v=scan(what="c",n=1,quiet=T);if(length(v)!=0&&v==mw){score=score+10*floor(nchar(mw)/3);cat("correct\n")} else cat("wrong\n");cat("score:",score,"\n\n")}

Python 335
I know I'm a bit late to the party, but python's not represented, so I figured what the heck:
import sys
import random
D=open(sys.argv[1]).read().split()
random.shuffle(D)
z=0
for L in range(1,10):
 M=L+3;N=M/3;w=[c for c in D if len(c)==M][0];U=list(w)
 for i in[random.randint(0,M-1)for i in range(N)]:U[i]='*'
 print"\nLevel %d\n=======\n"%L+''.join(U);k=raw_input()==w;z+=[0,N*10][k];print["wrong","correct"][k]+"\nscore:",z

And semi-ungolfed:
import sys
import random
words = open(sys.argv[1]).read().split()
random.shuffle(words)
score=0
for L in range(1,10):
   M=L+3
   N=M/3
   w=[c for c in words if len(c)==M][0]
   obfus=list(w)
   for i in [random.randint(0,M-1) for i in range(N)]: obfus[i]='*'
   obfus=''.join(obfus)
   print"\nLevel %d\n=======\n"%L+obfus
   correct=raw_input()==w
   score+=[0,N*10][correct]
   print["wrong","correct"][correct]+"\nscore:",score

K, 198
Assumes a dictionary d in the current working directory.
{O:{@[x;(-_c%3)?c:#x;:;"*"]}',/W:{1?x@&y=#:'x}[_0:`d]'4+!9;i:1+S:0;while[#O;-1"Level ",$i;-1"=======";-1@*O;$[(**W)~0:0;[-1"correct";S+:10*+/"*"=*O];-1"wrong"];-1"score: ",$S;-1"";W:1_W;O:1_O;i+:1]}

Ungolfed:
{
        /W = wordlist; O = obfuscated
        O:{@[x;(-_c%3)?c:#x;:;"*"]}',/W:{1?x@&y=#:'x}[_0:`d]'4+!9;
        i:1+S:0;
        while[#O;
                -1"Level ",$i;
                -1"=======";
                -1@*O;
                $[(**W)~0:0;              /Read user input and compare to the first word
                        [-1"correct";
                        S+:10*+/"*"=*O];  /if correct, increment score
                        -1"wrong"];
                -1"score: ",$S;
                -1"";
                W:1_W;                    /knock one off the top of both word lists
                O:1_O;
                i+:1]
}

Python 3.8 (pre-release), 283 bytes
from random import*
def f(w,s=0):
 for i in range(4,13):W=choice([t for t in w if len(t)==i]);C=sample([*range(i)],T:=i//3);print(f'''Level {i-3}
=======
'''+''.join(I in C and'*'or c for I,c in enumerate(W)));print(['wrong','correct'][(Z:=input()==W)]+f'\nscore: {(s:=s+Z*10*T)}\n')

Try it online!
I'm on Windows so it's hard to test. But there is a version here on a different interpreter site that uses a list of words compiled from here. (albeit only about 8000 words).

license: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/3.0/

all_licenses: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/2.5/

all_licenses: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/4.0/


text:
Shortest URL regex match in JavaScript
Create the shortest regular expression that will roughly match a URL in text when run in JavaScript
Example:
"some text exampley.com".match(/your regular expression goes here/);

The regular expression needs to

capture all valid URLS that are for http and https.
not worry about not matching for URL looking strings that aren't actually valid URLS like super.awesome/cool
be valid when run as a JavaScript regex

Test criteria:
Match:

http://example.com
http://example.com/
http://example.com/super
https://example.com/super
example.com/super
example.com
example.com/su-per_duper/?add=yes&subtract=no
example.com/archive/index.html
twitter.com/#!/reply
example.com/234ret2398oent/234nth
codegolf.stackexchange.com/questions/464
crazy.wow.really.example.com/?cat=nth%3E
example-example.com
example1.com

Not Match:

example
super/cool
Good Morning
i:can
hello.

Here is a test that might help clarify a bit http://jsfiddle.net/MikeGrace/gsJyr/
I apologize for the lack of clarity, I hadn't realized how awful matching URLs was.

Ahgrrrr! I miss my edit privileges! I you're going to restrict the game to one language perhaps you should tag it with that language.

What constitute a valid URL character? because I can simply use \w for everything Do you expect backreferences for different URL components?

"A URI is a sequence of characters from a very limited set, i.e. the letters of the basic Latin alphabet, digits, and a few special characters," according to RFC 2396.

Mike: I guess there is still some clarification in order. As it stands now I can just use /:/ as the regular expression and match valid URIs and not match all your examples on the »Not match« list. As long as you're going that route it's simply the question: What is the shortest regular expression that will not match any of the example strings but still catch all URIs.

I think this questions seems to be a "give me teh codez" question.

@M28 the lack of clarity may seem that way but I did learn a lot from it and I'm still working on my own answer. If you think it should be deleted we can do that if it is better for the community.

Just try to write a longer challenge with more details.

Voting to close as there is no specification of what you count as a URL. Should we allow usernames/passwords in the URL? Ports? Should we validate URL lengths?

I agree with Redwolf, in that this challenge requires a full spec of what is and isn't a valid URL, rather than that being defined through the test cases.

Since this challenge is long inactive and I think the clarity points are uncontroversial by today's standards, I am going to be using my power as moderator to close this question.  Feel free to flag this for attention if the issues have been resolved, or given the age of the question ask it again fresh (although I would recommend the sandbox first to make sure the spec is solid).

/.+\.\w\w.*/

doesn't match 3 strings that it shouldn't, matches almost anything else ;)
upd: it still doesn't match all 5

This one works:
var re = /(^|\s)((https?:\/\/)?[\w-]+(\.[\w-]+)+\.?(:\d+)?(\/\S*)?)/gi;

/*
(^|\s)                            : ensure that we are not matching an url
                                    embeded in an other string
(https?:\/\/)?                    : the http or https schemes (optional)
[\w-]+(\.[\w-]+)+\.?              : domain name with at least two components;
                                    allows a trailing dot
(:\d+)?                           : the port (optional)
(\/\S*)?                          : the path (optional)
*/

Passes the tests at http://jsfiddle.net/9BYdp/1/
Also matches:

example.com. (trailing dot)
example.com:8080 (port)

Sweetness!!!!!!!

Wouldn't you want to match a hostname with only one component as well (e.g. localhost)?

This allows spaces

works for me. ty :)

Works nice, but not for domains with user/password parts e.g. http://user:password@domain.com/path

This obviously doesn't do what you intend, but it meets your criteria:
 /.*/

"match all valid URLS that are for http and https."
yep, definately will match.
"not worry about not matching for URL looking strings that aren't actually valid URLS like 'super.awesome/cool'"
yeah, sure, there will be lots of false positives, but you said that doesn't matter.
be valid when run as a JavaScript regex
sure as eggs works as you say it should.

If this result is NOT a right answer, then you need to be more selective with your criteria.
In order to be a rule that works as you intend, you actually do need to implement a full RFC compliant matcher, and a full RFC compliant matcher will "worry about not matching".
So, in terms of "permit not matching", you need to specify exactly which deviations from RFC are permissible.
Anything else, and this whole exercise is a sham, because people will just write whatever works for them, or how they like it, and sacrifice "making any sense" in favour of being short ( like I did ).
On your update
The most Naïve regex I can come up with that matches (and captures) all your pasted examples so far is:
/(\S+\.[^/\s]+(\/\S+|\/|))/g;

Its quite simple in nature, and assumes only 3 basic forms are possible.
x.y
x.y/
x.y/z

z can be anthing not whitespace.
x can be anything not whitespace.
y can be anything that is neither whitespace or a '/' character.
There are a lot of things that will be valid to this rule, lots, but they'll at least look like a valid URI to a human, they just won't be specifications compatible.
eg:
hello.0/1  # valid
1.2/1 # valid
muffins://¥.µ/€  # probably valid

I think the sane approach is to extract things that are likely to be URI's, then validate them with something stricter, I'm looking at working out how to use the browsers URI class to validate them =).
But you can see the above reasoning working on this sample here: http://jsfiddle.net/mHbXx/

He changed the question, but you can do better anyway with /:/ even after the edit :-)

Thanks Mike =). I don't wish to compete myself in a more serious manner, the other suggestions are more useful, I just wished to point out the problem with the initial premise so that the question quality could improve =)

Is it only me or is this matching "www .google .com"?

/https?\:\/\/\w+((\:\d+)?\/\S*)?/

Try that.
I'm including the leading and trailing slashes that delimit the regular expression, so hopefully that doesn't hurt my character count!
This pattern limits the protocol to either http or https, allows for an optional port number, and then allows any character except whitespace.

source: Stack Exchange

all_licenses: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/3.0/

sort: votes


text:
Implement glob Matcher
Implement a function of pattern and string to be matched, return true if the pattern matches the WHOLE string, otherwise false.
Our glob pattern syntax is:

? matches any one character
+ matches one or more characters
* matches zero or more characters
\ escapes

Rules:

No eval, no converting into regular expression, no calling a system glob function.
I/O are not required: you can just write a function
Shortest wins

Examples:
glob('abc', 'abc') => true
glob('abc', 'abcdef') => false IMPORTANT!
glob('a??', 'aww') => true
glob('a*b', 'ab') => true
glob('a*b', 'agwijgwbgioeb') => true
glob('a*?', 'a') => false
glob('?*', 'def') => true
glob('5+', '5ggggg') => true
glob('+', '') => false
glob('a\*b', 'a*b') => true

Here is a tip to get started: http://en.wikipedia.org/wiki/Backtracking

May I suggest an additional tag "pattern-matching"?

Could you clarify what you mean by "no standard function"? That you can't call functions from the standard library? How is that supposed to work?

Some examples on escaping please? ("")

Golfscript - 82 chars
{1,\@n+:|;{:<;{:I)I|="\\+*?"[<]+?[{|=<={I))}*}I~{I\C}{}.{;}]=~}:C%}/{|>'*'-n=},}:g

Assumes that there are no newlines in the strings. Returns an empty array for false, and a non-empty array for true (consistent with golfscript definition of true/false).
This is a non-recursive solution (except for consecutive *s), which maintains a list of the positions in the pattern string i such that pattern[0..i] matches string[0..cur].
This has the potential to run for a very long time. You can add .& after :C% to prevent this.

Haskell, 141 characters
c('\\':a:z)s=a&s>>=c z
c(a:z)s=a%s>>=c z
c[]s=[null s]
p&(a:z)|a==p=[z]
_&_=[]
'?'%(a:z)=[z]
'*'%a=a:'+'%a
'+'%(a:z)='*'%z
l%a=l&a
g=(or.).c

Works for all input, both patterns and strings to match against. Handles trailing backslash in the pattern as a literal match (behavior was unspecified.)
This can be run with the following test driver:
main = do
    globtest "abc" "abc"    True
    globtest "abc" "abcdef" False
    globtest "a??" "aww"    True
    globtest "a*b" "ab"     True
    globtest "a*b" "agwijgwbgioeb" True
    globtest "a*?" "a"      False
    globtest "?*" "def"     True
    globtest "5+" "5ggggg"  True
    globtest "+" ""         False
    globtest "a\\*b" "a*b"  True
  where
    globtest p s e =
      if g p s == e
        then putStrLn "pass"
        else putStrLn$"fail: g " ++ show p ++ " " ++ show s ++ " /= " ++ show e

Update: I wrote a blog post about this particular answer, as I think it shows off well how Haskell so easily encodes the problem.

Edit: (181 -> 174) replaced d and m with operators
Edit: (174 -> 151) inlined r into c
Edit: (151 -> 149) removed an unnecessarily generated option in the + case
Edit: (149 -> 141) removed an unnecessary clause for %, which was handled by &

JavaScript - 259 characters
My implementation is very recursive, so the stack will overflow if an extremely long pattern is used. Ignoring the plus sign (which I could have optimized but chose not to for simplicity), one level of recursion is used for each token.
glob=function f(e,c){var b=e[0],d=e.slice(1),g=c.length;if(b=="+")return f("?*"+d,c);if(b=="?")b=g;else if(b=="*"){for(b=0;b<=g;++b)if(f(d,c.slice(b)))return 1;return 0}else{if(b=="\\"){b=e[1];d=e.slice(2)}b=b==c[0]}return b&&(!d.length&&!g||f(d,c.slice(1)))}

The function sometimes returns a number instead of a boolean. If that is a problem, you can use it as !!glob(pattern, str).

Ungolfed (unminified, rather) to serve as a useful resource:
function glob(pattern, str) {
    var head = pattern[0], tail = pattern.slice(1), strLen = str.length, matched;
    if(head == '+') {
        // The plus is really just syntactic sugar.
        return glob('?*' + tail, str);
    }
    if(head == '?') { // Match any single character
        matched = strLen;
    } else if(head == '*') { // Match zero or more characters.
        // N.B. I reuse the variable matched to save space.
        for(matched = 0; matched <= strLen; ++matched) {
            if(glob(tail, str.slice(matched))) {
                return 1;
            }
        }
        return 0;
    } else { // Match a literal character
        if(head == '\\') { // Handle escaping
            head = pattern[1];
            tail = pattern.slice(2);
        }
        matched = head == str[0];
    }
    return matched && ((!tail.length && !strLen) || glob(tail, str.slice(1)));
}

Note that indexing into characters of a string as for array elements is not part of the older (ECMAScript 3) language standard, so it may not work in older browsers.

PHP - 275 243 characters
<?function g($P,$I){$o='array_shift';if(@$I[0]==="")return 0;for(;$P;$o($P)){$p=$P[0];if($p=='?'|$p=='+'&&@$N===$o($I))return 0;if($p=='+'|$p=='*'&&$I&&g($P,array_slice($I,1)))return 1;if(!strpos(" ?+*\\",$p)&&$p!==$o($I))return 0;}return!$I;}

Ungolfed:
<?php

function g($P,$I) {
        if ($I && $I[0] === "") return false;
        for(;$P;array_shift($P)) {
                $p = $P[0];
                if( $p == '?' || $p == '+') {
                        if (NULL === array_shift($I)) {
                                return false;
                        }
                }
                if( $p=='+' || $p=='*' ) {
                        if ($I && g($P, array_slice($I,1))) {
                                return true;
                        }
                }
                if (!strpos(" ?+*\\",$p) && $p !== array_shift($I)) {
                        return false;
                }
        }
        return !$I;
}

function my_glob($pattern,$subject) {
    return !!g(str_split($pattern),str_split($subject));
}

Overly Verbose Python (384 367 Characters)
t=lambda a:a[1:]
h=lambda a:a[0]
n=lambda p,s:s and(h(p)==h(s)and m(t(p),t(s)))
def m(p,s):
 if not p:
  return not s
 else:
  return {
   '?':lambda p,s:s and m(t(p),t(s)),
   '+':lambda p,s:s and(m(p,t(s))or m(t(p),t(s))),
   '*':lambda p,s:m(t(p),s)or(s and m(p,t(s))),
   '\\':lambda p,s:n(t(p),s),
  }.get(h(p),n)(p,s)
glob=lambda p,s:not not m(p,s)

It's not the shortest, but it's nice and functional. The dispatch dict thing in the middle could presumably be rewritten as a disjunction over (h(p) == '?') and (? lambda body) type things. Defining that h operator costs me some characters for no benefit, but its nice to have a keyword for head.
I'd like to have a crack at golfscripting it later if time permits.
edit: removed unnecessary third branch in '*' case after reading user300's ruby answer

Ruby - 199 171
g=->p,s{x=(b=->a{a[1..-1]})[p];y=s[0];w=b[s];v=p[0];_=->p,s{p[0]==y&&g[x,w]}
v==??? g[x,y&&w||s]:v==?+? y&&g[?*+x,w]:v==?*?
y&&g[p,w]||g[x,s]:v==?\\? _[x,s]:v ? _[p,s]:!y}

Ungolfed:
def glob(pattern, subject)
        b=->a{a[1..-1]}
        _=->p,s{ p[0]==s[0] && glob(b[p],b[s]) }
        ({
                ??=>->p,s { glob(b[p], s[0] ? b[s] : s) },
                ?+=>->p,s { s[0] && glob(?*+b[p], b[s]) },
                ?*=>->p,s { s[0] && glob(p,b[s]) || glob(b[p],s) },
                ?\\=>->p,s{ _[b[p],s] },
                nil=>->p,s{ !subject[0] }
        }[pattern[0]] || _)[pattern, subject]
end

Tests:
p glob('abc', 'abc')
p glob('abc', 'abcdef')
p glob('a??', 'aww')
p glob('a*b', 'ab')
p glob('a*b', 'agwijgwbgioeb')
p glob('a*?', 'a')
p glob('?*', 'def')
p glob('5+', '5ggggg')
p glob('+', '')

Inspired by roobs' answer

i know nothing about ruby, but from your code i've learnt that accessing out of bounds indices returns nil. so popping an empty string yields a nil value which can be used as a string terminator symbol. C-style! nifty! i guess it could be mimicked in python by passing each input string through lambda s : list(s)+[None]

From the looks of it, Ruby has built in pattern matching. That's certainly handy for this sort of problem.

Actually the ?? are literal chars, => are key/value separators in Ruby Hashes, and -> starts a lambda :-) ( { ?? => ->{...} } is a hash with key "?" and a lambda as value.) But yes the way its used together looks like pattern-matching on single chars :-)

Shorter Snappier Python 2.6 (272 characters)
golfed:
n=lambda p,s:p[0]==s[0]and m(p[1:],s[1:])
def m(p,s):
 q,r,t,u=p[0],p[1:],s[0],s[1:]
 return any((q=='?'and(t and m(r,u)),q=='+'and(t and(m(p,u)or m(r,u))),q=='*'and(m(r,s)or(t and m(p,u))),q=='\\'and n(r,s),q==t==0))or n(p,s)
glob=lambda*a:m(*[list(x)+[0]for x in a])

ungolfed:
TERMINATOR = 0

def unpack(a):
    return a[0], a[1:]

def terminated_string(s):
    return list(s) + [TERMINATOR]

def match_literal(p, s):
    p_head, p_tail = unpack(p)
    s_head, s_tail = unpack(s)
    return p_head == s_head and match(p_tail, s_tail)

def match(p, s):
    p_head, p_tail = unpack(p)
    s_head, s_tail = unpack(s)
    return any((
        p_head == '?' and (s_head and match(p_tail, s_tail)),
        p_head == '+' and (s_head and(match(p, s_tail) or match(p_tail, s_tail))),
        p_head == '*' and (match(p_tail, s) or (s_head and match(p, s_tail))),
        p_head == '\\' and match_literal(p_tail, s),
        p_head == s_head == TERMINATOR,
    )) or match_literal(p, s)

def glob(p, s):
    return match(terminated_string(p), terminated_string(s))

featuring:

lazily-evaluated logical mess!
C style strings!
cute multiple comparison idiom!
plenty of ugly!

credit to user300's answer for illustrating how things are simplified if you can get some kind of terminator value when popping the head from an empty string.
i wish the head/tail unpacking could be performed inline during the declaration of m's arguments. then m could be a lambda, just like its friends n and glob. python2 cannot do it, and after a bit of reading, it looks like python3 cannot either. woe.
testing:
test_cases = {
    ('abc', 'abc') : True,
    ('abc', 'abcdef') : False,
    ('a??', 'aww') : True,
    ('a*b', 'ab') : True,
    ('a*b', 'aqwghfkjdfgshkfsfddsobbob') : True,
    ('a*?', 'a') : False,
    ('?*', 'def') : True,
    ('5+', '5ggggg') : True,
    ('+', '') : False,
}
for (p, s) in test_cases:
    computed_result = glob(p, s)
    desired_result = test_cases[(p, s)]
    print '%s %s' % (p, s)
    print '\tPASS' if (computed_result == desired_result) else '\tFAIL'

C function - 178 necessary characters
Compiled with GCC, this produces no warnings.
#define g glob
int g(p,s)const char*p,*s;{return*p==42?g(p+1,s)||(*s&&g(p,
s+1)):*p==43?*s&&(g(p+1,++s)||g(p,s)):*p==63?*s&&g(p+1,s+1)
:*p==92?*++p&&*s++==*p++&&g(p,s):*s==*p++&&(!*s++||g(p,s));}
#undef g

The first and last lines are not included in the character count.  They are provided for convenience only.
Blown-up:
int glob(p,s)
const char *p, *s; /* K&R-style function declaration */
{
    return
        *p=='*'  ? glob(p+1,s) || (*s && glob(p,s+1)) :
        *p=='+'  ? *s && (glob(p+1,++s) || glob(p,s)) :
        *p=='?'  ? *s && glob(p+1,s+1)                :
        *p=='\\' ? *++p && *s++==*p++ && glob(p,s)    :
        *s==*p++ && (!*s++ || glob(p,s));
}

Python (454 characters)
def glob(p,s):
  ps,pns=[0],[]
  for ch in s:
    for i in ps:
      if i<0:
        pns+=[i]
        if i>-len(p) and p[-i]==ch:pns+=[-i]
      elif i<len(p):
        pc=p[i]
        d={'?':[i+1],'+':[i,-i-1],'*':[i+1,-i-1]}
        if pc in d:pns+=d[pc]
        else:
          if pc=='\\':pc=p[i+1]
          if pc==ch:pns+=[i+1]
    ps,pns=pns,[]
  if (s or p in '*') and (len(p) in ps or -len(p)+1 in ps or -len(p) in ps): return True
  return False

D: 363 Characters
bool glob(S)(S s,S t){alias front f;alias popFront p;alias empty e;while(!e(s)&&!e(t)){switch(f(s)){case'+':if(e(t))return false;p(t);case'*':p(s);if(e(s))return true;if(f(s)!='+'&&f(s)!='*'){for(;!e(t);p(t)){if(f(s)==f(t)&&glob(s,t))return true;}}break;case'\\':p(s);if(e(s))return false;default:if(f(s)!=f(s))return false;case'?':p(s);p(t);}}return e(s)&&e(t);}

More Legibly:
bool glob(S)(S s, S t)
{
    alias front f;
    alias popFront p;
    alias empty e;

    while(!e(s) && !e(t))
    {
        switch(f(s))
        {
            case '+':
                if(e(t))
                    return false;

                p(t);
            case '*':
                p(s);

                if(e(s))
                    return true;

                if(f(s) != '+' && f(s) != '*')
                {
                    for(; !e(t); p(t))
                    {
                        if(f(s) == f(t) && glob(s, t))
                            return true;
                    }
                }

                break;
            case '\\':
                p(s);

                if(e(s))
                    return false;
            default:
                if(f(s) != f(s))
                    return false;
            case '?':
                p(s);
                p(t);
        }
    }

    return e(s) && e(t);
}

golfscript
{{;;}2$+}:x;{x if}:a;{x\if}:o;{1$1$}:b;{(@(@={\m}a}:r;{b(63={\({\m}a}a{b(43={\({\b m{'+'\+m}o}a}a{b(42={b m{\({\'*'\+m}a}o}a{b(92={r}a{b 0=0=\0=0=*{r}o}o}o}o}o}:m;{[0]+\[0]+m}:glob;

it's built out of functions that consume two arguments from the stack, s and p, and produce a single boolean return value. there's a bit of mucking around to make that compatible with the lazy and and lazy or operators. i really doubt this approach is anywhere near optimal, or even in the right direction.
there's also a few entertainingly stupid moments, such as popping a '*' off the pattern, consuming the '*' in a comparison, only to realise that the subsequent branch doesn't match. in order to go down the other branch, we need the pattern with the '*' on the front, but we've consumed that original pattern when we popped the '*', and we consumed the '*', so to get ourselves the pattern again we load a shiny new string constant '*', and prepend it in place. it gets even uglier because for some reason the character matching needs to be done with ascii values, but prepending back onto the string needs strings.
less golfed golfscript
{[0]+}:terminate_string;
{{;;}2$+if}:_and;
{{;;}2$+\if}:_or;
{1$1$}:branch;
{(@(@={\match}_and}:match_literal;
{0=0=\0=0=*}:match_terminator;
{(92={match_literal}_and}:match_escape;
{(63={\({\match}_and}_and}:match_wildcard;
{(43={\({\branch match{'+'\+match}_or}_and}_and}:match_wildcard_plus;
{(42={branch match{\({\'*'\+match}_and}_or}_and}:match_wildcard_star;
{branch match_wildcard{branch match_wildcard_plus{branch match_wildcard_star{branch match_escape{branch match_terminator{match_literal}_or}_or}_or}_or}_or}:match;
{terminate_string\terminate_string match}:glob;

tests
{2$2$glob = "test passed: " "test FAILED: " if print \ print ' ; ' print print "\n" print}:test_case;

'abc' 'abc' 1 test_case
'abc' 'abcdef' 0 test_case
'a??' 'aww' 1 test_case
'a*b' 'ab' 1 test_case
'a*b' 'agwijgwbgioeb' 1 test_case
'a*?' 'a' 0 test_case
'?*' 'def' 1 test_case
'5+' '5ggggg' 1 test_case
'+' '' 0 test_case

C# (251 chars)
static bool g(string p,string i){try{char c;System.Func<string,string>s=t=>t.Remove(0,1);return p==i||((c=p[0])==92?p[1]==i[0]&g(s(s(p)),s(i)):c==42?g(s(p),i)||g(p,s(i)):c==43?g(s(p),s(i))|g(p,s(i)):g(s(p),s(i))&(c==i[0]|c==63));}catch{return false;}}

Slightly more readable:
static bool g(string p /* pattern */, string i /* input string */)
{
    // Instead of checking whether we’ve reached the end of the string, just
    // catch the out-of-range exception thrown by the string indexing operator
    try
    {
        char c;

        // .Remove(0,1) is shorter than .Substring(1)...
        System.Func<string, string> s = t => t.Remove(0, 1);

        // Note that every glob matches itself!† This saves us having to write
        // “(p=="" & i=="")” which would be much longer — very convenient!
        return p == i || (

            // backslash escapes
            (c = p[0]) == 92 ? p[1] == i[0] & g(s(s(p)), s(i)) :

            // '*' — need “||” so that s(i) doesn’t throw if the first part is true
            c == 42 ? g(s(p), i) || g(p, s(i)) :

            // '+'
            c == 43 ? g(s(p), s(i)) | g(p, s(i)) :

            // '?' or any other character
            g(s(p), s(i)) & (c == i[0] | c == 63)
        );
    }

    // If we ever access beyond the end of the string, we know the glob doesn’t match
    catch { return false; }
}

† I know, I know... except for globs containing the backslash. Which is really unfortunate. It would have been really clever otherwise. :(

license: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/2.5/