Tcl, 69 bytes

proc C a\ b {proc S x {lsort -u [split $x ""]}
regexp [S $b] [S $a]]}

Try it online!

J-uby -rset, 16 bytes

(A|:to_set)**:>=

Attempt This Online! (Uses an older, working version of J-uby’s ** operator.)

Converts each argument (**) to an array of characters (A), then to a Set (:to_set), then tests if the first is a superset of the second (:>=).

C, 50 bytes, see comment below

f(int*a,int*b){return*b?wcschr(a,*b)&&f(a,b+1):1;}

C (gcc), 51 bytes

f(a,b)int*a,*b;{return wcschr(a,*b)&&f(a,b+1)|!*b;}

Try it online!

In this 51 bytes version I tweaked a little bit the 53 bytes version (see below, former answer) thanks to && :

• At each letter *b I check we can find it in string a.
• If not, it means wcschr(a,*b) equal 0, so the program will not bother to execute the second part &&f(a,b+1) (that allows us to go deeper in the recursive) and so it return 0...
• ...along with !*b | NOT of pointer b: if we had arrived at the end of b, the pointer is NULL so we return 0|!NULL <=> 0|1 <=> 1. If the pointer is not NULL (which means wcschr(a,*b) previously returned NULL before string a's \0) then we return 0|!PTR <=> 0|0 <=> 0

C (gcc), 53 bytes

f(a,b)int*a,*b;{return*b&&wcschr(a,*b)?f(a,b+1):!*b;}

Try it online!

This is a recursive function

• wcschr(a,*b) looks for unicode character *b in string a, return NULL character is not found, else pointer to the character (!=NULL).
• We keep looking if 1/ we are not at the end of string b (*b!=NULL) and 2/ while we keep finding our char *b in string a.
• If both conditions are true we inspect our next character in string b f(a,b+1)
• if not we return NOT of the pointer to *b : if we had arrived at the end of b then *b is NULL and our function return true, if not it means that wcschr failed before reaching end of string b.

NB: wcschr is the builtin function equivalent of strchr (man strchr)

#include <wchar.h>
#ifndef WCSCHR
# define WCSCHR __wcschr
#endif
/* Find the first occurrence of WC in WCS.  */
wchar_t *
WCSCHR (const wchar_t *wcs, const wchar_t wc)
{
  do
    if (*wcs == wc)
      return (wchar_t *) wcs;
  while (*wcs++ != L'\0');
  return NULL;
}
libc_hidden_def (__wcschr)
weak_alias (__wcschr, wcschr)
libc_hidden_weak (wcschr)

Thunno 2 !, 1 byte

ṗ

Try it online!

Explanation

   # Implicit input
ṗ  # Set difference
   # Logical NOT
   # Implicit output

Factor + math.unicode, 3 bytes

⊃

Try it online!

An alias for superset?.

Java, 57 49 48 bytes

a->b->(b+'␀'+a).matches("((.)(?=.*␀.*\\2))*␀.*")

Try it online!

This uses the ECMAScript / Python / universal regex from my pure regex answer.

An actual NUL (ASCII 0) character is used as the delimiter for maximum universality. This is inserted directly into the TIO test harness as actual NUL characters, but displayed above using the ␀ glyph for visibility.

Perl 5, 46 41 39 bytes

-2 bytes thanks to dingledooper

sub{pop.'␀'.pop~~/^((.)(?=.*␀.*\2))*␀/}

Try it online!

This uses the ECMAScript / Python / universal regex from my pure regex answer (explained there). The unprintable character NUL (ASCII 0) is used as the delimiter, shown here as ␀.

Vyxal, 2 bytes

F¬

Try it online or verify all test cases.

Regex (ECMAScript 2018 / Python^regex / .NET), 20 bytes

Takes the two strings in joined format, delimited by a single newline. That is why there are two newlines in the regex itself (saving 2 bytes compared to if \n were used):

((.)(?<=\2.*
.*))*$

Try it online! - ECMAScript 2018
Try it online! - Python _{^{import regex}}
Try it online! - .NET

It just so happens that the order of String 1 and String 2 dictated by this question is the one that makes it a bit nontrivial in regex, impossible to do without variable-length lookbehind or non-atomic lookahead. If it were the other way around, it would be possible in vanilla ECMAScript.

\n         # 1. Find the newline, so we can match against String 2
(          # 2. Start loop at the beginning of String 2
  (.)      # 3. At every iteration, capture another character from String 2 into \2
  (?<=     # 4. positive lookbehind - look backwards
    \2.*   # 6. Assert that the captured character \2 can be found in String 1
    \n.*   # 5. Find the newline, so we can match against String 1
  )
)*         # 7. Continue the loop as long as possible
$          # 8. Assert that when the loop has finished, we've reached String 2's end

Regex (Java), 29 or 27 bytes

Java has a limited sort of variable-length lookbehind. It's unlimited in length, but there are strict limits as to what is allowed in a lookbehind (most notably, all backreferences must be inside a lookahead inside the lookbehind), and stricter limits on what will actually work in a lookbehind. So in principle it has the same power as full-fledged variable-length lookbehind in its ability to solve computation problems, but will do so less efficiently.

In this case, two limits come into play: \2 need to be backreferenced in a lookahead, and apparently, if an expression like .*x.* is in a lookbehind (where x is any character), it will silently fail to work properly. Here we work around this problem by collapsing the .*\n.* into [\s\S]*:

((.)(?<=^(?=.*\2)[\s\S]*))*$

29 bytes - Try it online!

This problem could also be solved by using comma as a delimiter instead of newline:

,((.)(?<=^(?=[^,]*\2).*))*$

27 bytes - Try it online!

Or by using the s (dotall) flag with newline as the delimiter:

((.)(?<=^(?=[^
]*\2).*))*$

27 bytes - Try it online!

Regex (PCRE1), 48 bytes + s flag

It is possible to emulate variable-length lookbehind using recursive constant-width lookbehind:

((.)((?<=(?=
((?<=(?=$.|\2|(?4)).))|(?3)).)))*$

Try it online! (C++)
Try it on regex101

The recursive lookbehind goes through two stages in this regex: first (?3) to find the newline, and then (?4) to find the captured character. The regex could be 1 byte shorter if some character that is guaranteed not to be present in the input were used as the dummy impossible match instead of $..

/s single line mode (dotall) is used so that newline can be the delimiter, with the . in the lookbehinds being allowed to match it. With any other choice of delimiter (even a control character), this flag would not be needed. Therefore, I have not included it in the byte count. FWIW though, keeping newline as the delimiter and not using /s mode would require upping the length to 52 bytes (with a regex that runs much more slowly, due to putting the newline after the lookbehind), costing the same in bytes as adding (?s) would, thus not worthwhile.

Regex (PCRE2 / Perl 5), 45 bytes + s flag

Same approach as PCRE1, but the dummy impossible match $. is no longer needed to avoid a "recursive call could loop indefinitely" error:

((.)((?<=(?=
((?<=(?=\2|(?4)).))|(?3)).)))*$

Try it online! - PCRE2 (C++)
Try it online! - PCRE2 (PHP – doesn't work, and I don't know why)
Try it online! - Perl 5

Regex (PCRE2) length-limited, 39 38\$+\lfloor log_{10}L_{max}\rfloor\$ bytes

It is possible to emulate molecular lookbehind (and some of the power of variable-length lookbehind) using jaytea's lookahead quantification trick, but this limits the maximum possible length of String 2 to 1023 characters. In the linked blog post I commented (as Davidebyzero) on a way to extend this limit by a couple of orders of magnitude, but it nevertheless remains.

This trick does not work in Perl 5, because apparently it has the same "no empty optional" behavior as ECMAScript. [Edit: This isn't true in most circumstances. Needs to be looked into.]

1 byte can be saved by omitting the anchor. Any non-match will remain a non-match even if it is attempted from later positions in the first string, because if the second string isn't made up of a subset of the first string's characters, it certainly won't be made up of a smaller subset. This does result in a slowdown for non-matches.

((?=(?=.*
(\2?(.?))).*\3)){1,1023}?.*
\2$

Try it online! (C++)
Try it online! (PHP)

Regex (PCRE2) length-limited const, 36 35\$+\lfloor log_{10}L_{max}\rfloor\$ bytes

The regex still works with a constant quantifier (for a total length of 39 bytes), but will take more steps (but not necessarily much more time, depending on the optimization done by the regex engine).

((?=(?=.*
(\2?(.?))).*\3)){1149}.*
\2$

Try it online! (C++)
Try it online! (PHP)

Regex (Perl 5 / .NET / Java) length-limited const, 34 33\$+\lfloor log_{10}L_{max}\rfloor\$ bytes

This version works in Perl, in which the quantifier can go up to {32766} (which would make a regex length of 40 bytes, and still execute fast), and in Java, in which the quantifier apparently can go up to {400000000165150719} (but must be much smaller for execution time to be practical).

PCRE1 (and PCRE2 earlier than v10.35), as well as Ruby, treat any quantifer greater than 1 on a lookaround as being 1, so the lookaround must be wrapped in a dummy group, costing 2 bytes. But in Perl 5, .NET, Java, and Python 3, lookarounds can be directly quantified:

(?=(?=.*
(\1?(.?))).*\2){9999}.*
\1$

Try it online! - Perl 5
Try it online! - .NET (C#)
Try it online! - Java - 1 byte longer – needs the anchor for some reason – this needs investigation

Regex (PCRE1) length-limited, {45 or 42 44 or 41}\$+\lfloor log_{10}L_{max}\rfloor\$ bytes

Due to a fundamental flaw in PCRE1's design, a workaround is needed to prevent the regex from returning truthy when the last character of String 2 is not present in String 1:

((?=(?=.*
(\2?(.?))).*\3.*(
\2))){1,481}?.*\4$

Try it online! (C++)
Try it on regex101

The regex still works with a constant quantifier, but will take more steps (but not necessarily much more time, depending on the optimization done by the regex engine):

((?=(?=.*
(\2?(.?))).*\3.*(
\2))){500}.*\4$

Try it online! (C++)
Try it on regex101

Regex (Ruby) length-limited, 50 49\$+\lfloor log_{10}L_{max}\rfloor\$ bytes

The lookahead quantification trick fully works in Ruby, and can go as high as {100000}. There is no support for nested backreferences, so \2 must be copied to \4 in a lookahead:

((?=(?=.*
(\4?(.?))).*\3(?=.*
(\2)))){1,100000}?.*
\2$

Try it online!

While Ruby's regex engine does have subroutine calls, and thus at first glance it might appear to be possible to adapt the solutions that emulate variable-length lookbehind to it, it does not appear to be possible to do so. Any attempt at recursion with subroutine calls generates the error "never ending recursion", even when there are clear-cut terminating conditions.

Regex (Python^regex) length-limited const, 44\$+\lfloor log_{10}L_{max}\rfloor\$ bytes

The lookahead quantification trick works in Python 3 (using the regex module rather than re), but only with a constant quantifier. This is a shame, because Python can go as high as {4294967294}, but increasing its value in this regex causes super-exponential slowdown. There is no support for nested backreferences, so just like the Ruby version, \2 must be copied to \4 in a lookahead.

(?=(?=.*
(\3?(.?))).*\2(?=.*
(\1))){300}.*
\1$

Try it online!

Regex (RegexMathEngine -xml), 27 bytes

In RegexMathEngine, molecular (non-atomic) lookahead can be used in the form of (?*...) when enabled using the -xml command line parameter ("enable extension: molecular lookahead").

This needs to be anchored because the delimiter is inside a negative lookahead, so without the anchor, a non-match could become a match by leapfrogging the delimiter and starting its match within the second string.

^(?!(?*.*,(.)+)(?!.*\1.*,))

Comma is the delimiter because it is not yet possible to work with strings containing newlines when using command-line invocation of this regex engine (which works as a one-line-at-a-time grep).

Regex (PCRE2 v10.35+), 27 24 bytes

PCRE does not have variable-length lookbehinds, but PCRE2 v10.34 has introduced non-atomic lookarounds in the form of (*napla:...) and (*naplb:...) (with the added synonyms of (?*...) and (?<*...) in v10.35), making it also able to solve this problem in the general case. This is shorter than in RegexMathEngine thanks to the use of newline as a delimiter:

^(?!(?*.*
(.)+)(?!.*\1))

Try it on regex101
Attempt This Online! (PHP)

You can change the delimiter (for example to comma: ^(?!(?*.*,(.)+)(?!.*\1.*,))), to test on the command line using pcre2grep.

If the strings were in the other order: Regex (ECMAScript / Python), 19 bytes

If String 2 comes before String 1, there is no need for lookbehind or non-atomic lookahead, and the solution is universal to all regex engines that have lookahead. It does now need to be anchored though, because otherwise, any non-match could become a match by discarding the beginning of the first string.

^((.)(?=.*
.*\2))*

Try it online! - ECMAScript
Try it online! - Python

^(          # start loop at the beginning of String 2
  (.)       # at every iteration, capture another character from String 2 into \2
  (?=.*\n   # look ahead to String 1 (by finding the newline)
    .*\2    # assert that the captured character \2 can be found in String 1
  )
)*          # continue the loop as long as possible
\n          # assert that when the loop has finished, we've reached String 2's end

Java, 90 Bytes

(String[] a)->a[1].chars().filter(x->!a[0].contains((String.valueOf((char)x)))).count()<1;

Try it online!

Not great, but chars() helps some...

x86-16 machine code, 14 bytes

00000000: 85c9 ac57 518b caf2 ae59 5fe1 f5c3       ...WQ....Y_...

Listing:

85 C9       TEST CX, CX         ; check for empty string
        S_LOOP: 
AC          LODSB               ; next char in string 2 
57          PUSH DI             ; save first string pointer 
51          PUSH CX             ; save first string length 
8B CA       MOV  CX, DX         ; put first string length into scan counter 
F2 AE       REPNZ SCASB         ; compare string 2 char to each in string 1 until match 
59          POP  CX             ; restore first string length 
5F          POP  DI             ; restore first string pointer 
E1 F5       LOOPZ S_LOOP        ; loop until end of second string OR no matches 
C3          RET                 ; return to caller

Callable function - input string 1 at [DI] length in DX, string 2 at [SI] length in CX. Output ZF if Truthy, NZ if Falsy.

Programming note: if input string 2 is empty, it will (harmlessly) loop 65,535 times in order to correctly return ZF. This is because LOOPcc decrements before testing for 0 so it must wrap around the 16-bit counter register before reaching 0 again. Otherwise a JZ or JCXZ after the TEST would eliminate this at a cost of +2 bytes, but hey, this is Code Golf not Efficiency Golf.

Tests:

Try it online!

Whispers v1, 50 43 bytes

> Input
> Input
>> {2}
>> 3⊆1
>> Output 4

Try it online!

Squeezed pseudo code:

>> Output ( Set(Input2) ⊆ Input 1)

Explanation:

As always in Whispers, we execute the last line first:

>> Output 4

Outputs the result of line 4:

>> 3⊆1

Returns a Boolean representing the result of line 3 being a subset of the result of line 1. Let's evaluate line 1 first:

>> Input

Takes the first line of the input.

Now line 3:

>> {2}

This line forms the set of the result of line 2, which takes the next line of input.

So we get the squashed pseudocode:

>> Output ( Set(Input2) ⊆ Input 1)

K (ngn/k), 5 bytes

~^&/?

Try it online!

A tacit function taking two arguments.

• ? find the indices of the first matches of the right-hand argument in the left-hand argument; returns 0N (null) if it's not present
• &/ take the minimum
• ~^ is the minimum not null?

Wolfram Language (Mathematica), 7 bytes

SubsetQ

Try it online!

SubsetQ does not account for multiplicity.

Kotlin, 50 bytes

{s1:String,s2:String->s2.filter{it !in s1}.none()}

Try it online!

PHP (7.4), 26 25 28 bytes

fn($a,$b)=>''>=strtok($b,$a)

Try it online!

PHP's strtok, basically removes characters of its second parameter, form its first parameter and returns the result or false if the result is empty. By removing $a characters from $b, if the result is empty (false), we output a truthy, else a falsy.

Christoph mentioned an issue with output of '0' from strtok (which equals to false), and to solve it, ''>= is used instead of a simple NOT (!) at a cost of +3 bytes. ''== would work the same way as well.

W, 2 bytes

Back then I definitely had the negation instruction. If you think it's boring then continue.

t!

Explanation

t  % Remove all characters of 1st input that appears in 2nd input.
   % e.g. ['abcdef','abc'] -> 'def'
 ! % Negate the result. So if the resulting string had something,
   % it will return falsy. Otherwise it will yield truthy.

W, 4 bytes

W is back, reimplemented!

t""=

If you want to specify your input and code, you look for imps.py and then re-set those variables like this:

read = ["abcabc","abc"]

prog = 't""='

Note that your inputs must be in a single array with the joined values.

Wren, 86 60 30 26 bytes

I didn't expect this. Wren is very hard to golf.

Fn.new{|a,b|b.trim(a)==""}

Try it online!

Explanation

Fn.new{                    // New anonymous function
       |a,b|               // With parameters a and b
            b.trim(a)      // After removing all characters in a that are in b
                           // (If b can be assembled using a the result should
                           // be a null string; otherwise it should be a
                           // non-empty string.
                     ==""} // Is this result an empty string?

Keg, 13 7 5 4 3 bytes

-⑫=

-1 byte due to the new ⑫ operator that pushes an empty string

Answer History

4 bytes

-``=

Try it online!

-1 byte with trailing newline

And y'all thought W could beat Keg!

This one's a bit of a stretch, as it uses a footer and header to define a function. I'll explain later.

Answer History

7 bytes (SBCS)

᠀᠀^-``=

Try it online!

-6 bytes due to the fact I realised I could just compare the result to an empty string.

Explained

᠀᠀^-``=
᠀᠀      #Take the two input strings
  ^     #Reverse stack to place strings in correct input order
   -    #Subtract the first string from the second
    ``= #Compare the result to an empty string, pushing either 1 or 0

13 bytes (SBCS)

᠀᠀^-÷!&ø&[0|1

Try it online!

Uses features from Keg, Reg and Keg+!

Explained

᠀᠀^-÷!&ø&[0|1
᠀᠀              #Take the two strings as input
  ^             #Reverse the stack so that string subtraction works
   -÷           #Subtract first input from second and item split the result
     !          #Push the length of this splitted string
      &ø&       #Safely store this length in the register while clearing the stack
         [0|1   #Push 0 if there are still items otherwise 1 if empty string

PowerShell, 34 bytes

param($a,$b)0-notin($b|%{$_-in$a})

Try it online!

Takes two arrays of chars as input.

Kotlin, 35 bytes

{a,b->(b.toSet()-a.toSet()).none()}

Try it online!

Python 3, 21 bytes

lambda a,b:{*a}>={*b}

Try it online!

Explanation

• * to unpacks the sequence/collection into positional arguments
• set >= other to test whether every element in other is in the set.

MATL, 3 bytes

wmA

Try it online! Or verify all test cases.

Explanation

The code implicitly takes two strings as inputs, swaps them, and verifies if All the characters in the first string (originally the second input) are members of the other string.

(A non-empty array containing exclusively ones is truthy in MATL. This would allow omitting A if it wasn't for the case with empty inputs).

Clojure, 39 Bytes

(fn[a b](every? #(contains?(set a)%)b))

Try it online!

05AB1E, 4 bytes

€ê`å

Try it online! or verify all test cases

Explanation

ې    Remove duplicates and sort each input
  `   Dump alphabets to the stack
   å  Check if the 2nd alphabet is contained in the 1st one

C# (.NET Core), 52 bytes 46 bytes 53 bytes

static bool f(string a, string b)=>b.All(a.Contains);

Try it online!

Julia 1.0, 19 bytes

x\y=all(c->c∈x,y)

Try it online!

Thought I beat python till I saw xnor's answer! Uses a generator to check if every character in y exists in (∈) x. Explanation: pass an anonymous function that checks if c is in x as the predicate to all, check that it returns true for all values in y.

Previous 22 byte solution: x\y=all(c∈x for c=y)

Try it online!

CJam, 5 bytes

ll\-!

Try it online!

Test Suite

Explanation

ll     Read 2 lines of input
  \    Swap their order
   -   Remove from the second input all characters in the first
    !  Negate

Ruby, 21 bytes

->x,y{!y.tr(x,"")[0]}

The tr method replaces all instances of the first string it's passed with the corresponding character in the second string it's passed. So all characters from x are removed from y. If there are any characters left, then it returns the first value (all values are truthy in ruby except false and nil) and inverses it. And if there are no characters left, then nil is inversed.

Golfy Tricks Implemented:

• Using y.tr(x,"") instead of y.chars-x.chars
• Using !array[0] instead of array.empty?

Try it online!

Gaia, 1 byte

⊃

Try it online!

Just a built-in. For strings, it checks for character-wise superset.

Test Suite

Python 2.7 .pyc file, 130 bytes

Sorry, bytecode formats are just too much fun to pass up for simpler tasks

Hexdump because there's plenty of nulls :)

00000000: 03f3 0d0a fb0b 8b59 6300 0000 0000 0000  .......Yc.......
00000010: 0004 0000 0040 0000 0073 1a00 0000 7400  .....@...s....t.
00000020: 0074 0100 6302 0083 0000 8301 0003 8300  .t..c...........
00000030: 0083 0100 6b05 0046 2800 0000 0028 0200  ....k..F(....(..
00000040: 0000 7303 0000 0073 6574 7309 0000 0072  ..s....sets....r
00000050: 6177 5f69 6e70 7574 2800 0000 0028 0000  aw_input(....(..
00000060: 0000 2800 0000 0073 0000 0000 7308 0000  ..(....s....s...
00000070: 003c 6d6f 6475 6c65 3e00 0000 0073 0000  .<module>....s..
00000080: 0000                                     ..

Optimizations over the in built compiler:

• Stack juggling the functions
• Zero byte filename because it's valid
• Crashing at the end because why spend a byte exiting cleanly

python-xdis output for the file:

# pydisasm version 4.1.0
# Python bytecode 2.7 (62211)
# Disassembled from Python 2.7.15+ (default, Jul  9 2019, 16:51:35)
# [GCC 7.4.0]
# Timestamp in code: 1502284795 (2017-08-09 13:19:55)
  0:
            LOAD_GLOBAL          (set)
            LOAD_GLOBAL          (raw_input)
            DUP_TOPX             2
            CALL_FUNCTION        0 (0 positional, 0 named)
            CALL_FUNCTION        1 (1 positional, 0 named)
            ROT_THREE
            CALL_FUNCTION        0 (0 positional, 0 named)
            CALL_FUNCTION        1 (1 positional, 0 named)
            COMPARE_OP           (>=)
            PRINT_EXPR

With bytes to make it easier to see where byte saves could be

# pydisasm version 4.1.0
# Python bytecode 2.7 (62211)
# Disassembled from Python 2.7.15+ (default, Jul  9 2019, 16:51:35)
# [GCC 7.4.0]
# Timestamp in code: 1502284795 (2017-08-09 13:19:55)
  0:           0 |74 00 00| LOAD_GLOBAL          (set)
               3 |74 00 01| LOAD_GLOBAL          (raw_input)
               6 |63 00 02| DUP_TOPX                  2
               9 |83 00 00| CALL_FUNCTION        (0 positional, 0 named)
              12 |83 00 01| CALL_FUNCTION        (1 positional, 0 named)
              15 |03      | ROT_THREE
              16 |83 00 00| CALL_FUNCTION        (0 positional, 0 named)
              19 |83 00 01| CALL_FUNCTION        (1 positional, 0 named)
              22 |6b 00 05| COMPARE_OP           (>=)
              25 |46      | PRINT_EXPR

Lua, 114 bytes

d=function(a,c,v)for _,k in ipairs(a) do c[k]=v end end
function l(a,b)c={};d(b,c,1);d(a,c);return not next(c) end

Try it online!

Couldn't get it shorter with plain Lua because lightweight Lua knows few builtins. If it needs to work with strings:

Lua, 116 bytes

function d(a,c,v)for _,k in a:gmatch"." do c[k]=v end end
function l(a,b)c={};d(b,c,1);d(a,c);return not next(c) end

Try it online!

Prolog (SWI), 92 bytes

e(_,[]).
e(L,[H|T]):-member(H,L),e(L,T).
f(X,Y):-string_chars(X,A),string_chars(Y,B),e(A,B).

Try it online!

Lua, 75 bytes

load'b,a=...return a:gsub(".",load"return not b:find(...,1,1)and [[]]")==a'

Try it online!

Now this is a bit messy. load is used to create function here, so everything inside is its body. Here, after taking input, following transformation is done: every symbol in second string is checked in first one. If it is found, internal function return false and no replacement is done. Otherwise, symbol is removed (replaced with empty string). Resulting string is compared with one passed as input, efficiently checking that no deletions were performed.

TIO link also include test cases.

APL (Dyalog Unicode), 3 bytes

×/∊

Try it online!

Use it as string2 f string1.

How it works

×/∊
  ∊  Does each char of string2 appear in string1?
×/   All of them?

Perl 6, 17 bytes

!(*R∖*)o**.comb

Try it online!

Also known as Raku. Anonymous code object taking two arguments and returning a boolean.

Explanation:

       **.comb   # Map each string to a list of characters
      o          # Then return if
  *R∖*           # The second argument set minus the first
!(    )          # Is empty?

C (gcc), 94 85 bytes

f(a,b,c)int*a,*b,*c;{for(;*b;++b){for(c=a;*c&&*c!=*b;++c);if(!*c)return 0;}return 1;}

Try it online!

-9 bytes from JL2210

Returns int: 1 for truthy and 0 for falsey.

Note: takes two parameters that are each pointers to null-terminated wide strings (wchar_t are the same size as int on the platform used on TIO, so we can take the strings as int* instead of including wchar.h and taking them as wchar_t*)

Explanation/Ungolfed:

#include <wchar.h>
int f(const wchar_t *a, const wchar_t *b) {
    for ( ; *b != L'\0'; ++b) { // For each character in the second string
        const wchar_t *temp;
        for (temp = a; *temp != L'\0'; ++temp) {
            if (*temp == *b) break;
            // If the character is in the first string,
            // then continue and check the next character
        }
        if (*temp == L'\0') return 0;
        // If the character was not found, return 0 (falsey)
    }
    return 1; // If every character was found, return 1 (truthy)
}

Scala, 46 bytes

(a:String,b:String)=>(b.toSet&~a.toSet)==Set()

Try it online!

Bracmat, 51 bytes

(f=a b.!arg:(?a,?b)&vap$((=.@(!a:? !arg ?)&|F).!b))

The function f returns a list of Fs, one F for each character in b that is not in a's alphabet. An empty list means that b's alphabet is contained in a's alphabet. The function vap splits the second argument, which must be a string, in UTF-8 encoded characters if the second argument (!b in this case) is valid UTF-8, and otherwise in bytes.

Try it online!

Python 3, 28 23 bytes

lambda x,y:not{*y}-{*x}

Try it online!

-5 bytes thanks to Wizzwizz4

28 bytes

lambda x,y:not set(y)-set(x)

Try it online!

Simply turns the two inputs into sets and subtracts the sets from each other

R, 40 bytes

function(x,y,`+`=utf8ToInt)all(+y%in%+x)

Try it online!

Japt -!, 3 bytes

VkU

Try it

VkU   U = first string, V = second
Vk    Remove all characters in V
  U   that are present in U
-!    If the string is empty, return true, else false

Haskell, 24 bytes

f a b=all(\c->elem c a)b

Try it online!

Rust, 106 104 bytes

|a:&str,b:&str|{let c=|x:&str|x.chars().collect::<std::collections::HashSet<_>>();c(b).is_subset(&c(a))}

Try it online!

• -2 bytes because

  On a technical level, Rust inserts

  extern crate std;
  

  into the crate root of every crate,

  — Rust docs, module std::prelude

Jelly, 3 bytes

fƑ@

Try it online!

A dyadic link taking two strings and returning a Boolean. If the order of the input s can be reversed, I could save one byte.

Works by checking whether the second string is unchanged when filtering to just the characters in the first.

Perl 5, 53 bytes

sub{local$_=pop;eval"y/@{[quotemeta pop]}//d";!y///c}

Try it online!

Zsh, 35 bytes

a=(${(s::)1})
((!${#${(s::)2}:|a}))

Try it online!

      ${(s::)2}        # split second parameter into characters
   ${          :|a}    # remove all elements of $a
   ${#            }    # count
((!                ))  # return truthy if 0, falsy if non-zero

Japt -!, 15 10 5 bytes

k@VøX

Try it online!

Thanks to @Shaggy for -5.

Charcoal, 5 bytes

⬤η№θι

Try it online! Link is to verbose version of code. Outputs a Charcoal boolean, i.e. - for true, nothing for false. Explanation:

⬤       All of
 η      Second string
  №     Count (is non-zero) in
   θ    First string of
    ι   Character of second string
        Implicitly print

JavaScript (ES6), 31 bytes

Takes arrays of characters as input.

a=>b=>b.every(c=>a.includes(c))

Try it online!

---

25 bytes

For the record, below is my original answer, which was designed for alphanumeric characters.

a=>b=>!b.match(`[^${a}]`)

Try it online!

J, 5 bytes

*/@e.

Try it online!

Is each char of the 2nd string an element of e. the 1st string? This returns a boolean mask, whose elements we multiply together with */. J is smart about 0 values so that if you apply */ to the empty list '' you get 1.

J, 6 bytes

''-:-.

Try it online!

Does the empty string '' match -: 1st string "set minused" -. from the 2nd?

Haskell, 13 bytes

all.flip elem

Try it online!

Haskell doesn't have built-in set or subset functions, so we need to do it ourselves. This is a pointfree version of

17 bytes

a%b=all(`elem`a)b

Try it online!

which it itself shortened from

22 bytes

a%b=and[elem c a|c<-b]

Try it online!

Brachylog, 3 bytes

dp⊆

Try it online!

Takes string 1 as the output variable and string 2 as the input variable.

Pyth, 7 bytes

g.{w.{w

Try it online!

First string on first line of input, second string on second line.