note 52415 deleted from function.preg-grep by didou

Note Submitter: erik dot dobecky at NOSPAM dot fi-us dot com ---- A useful way that we have developed filters against SQL injection attempts is to preg_grep the $_REQUEST global with the following regular expression (regex): '/[\'")]* *[oO][rR] *.*(.)(.) *= *\\2(?:--)?\\1?/' which is used simply as: <?php $SQLInjectionRegex = '/[\'")]* *[oO][rR] *.*(.)(.) *= *\\2(?:--)?\\1?/'; $suspiciousQueryItems = preg_grep($SQLInjectionRegex, $_REQUEST); ?> which matches any of the following (case insensitive, a=any char) strings (entirely): ' or 1=1-- " or 1=1-- or 1=1-- ' or 'a'='a " or "a"="a ') or ('a'='a