da_667 @da_667@infosec.exchange
Public

took an existing regex that catches sql injections and added on to it.

/[^\x3c]*?(?:\x27|%27|\x2d{2}|%2d%2d)?(?:(?:S(?:HOW.+(?:C(?:UR(?:DAT|TIM)E|HARACTER.+SET)|(?:VARI|T)ABLES)|ELECT.+(?:FROM|USER|SLEEP|CONCAT|CASE))|U(?:NION\x20SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO)|S(?:HOW.+(?:C(?:HARACTER.+SET|UR(DATE|TIME))|(?:VARI|T)ABLES)|ELECT.+(?:FROM|USER))|U(?:NION.+SELEC|PDATE.+SE)T|(?:NULL(?:\x2c|%2[cC])){2,}|(?:\x2f|%2[fF])(?:\x2a|%2[aA]).+(?:\x2a|%2[aA]).+(?:\x2f|%2[fF])|CONCAT.+SELECT|EXTRACTVALUE|UNION.+ALL)/i it's an arcane mess, but it catches a good bit.

0
0
0

If you have a fediverse account, you can quote this note from your own instance. Search https://infosec.exchange/users/da_667/statuses/114875980195032516 on your instance and quote it. (Note that quoting is not supported in Mastodon.)