https://community.cisco.com/t5/network-security/help-understanding-alarm-for-generic-sql-injection-in-http/m-p/858720#M84895 <P>I don't quite get the regex in 5474-1 shown below. The '+' I think I get; if the data is a GET or a POST with enctype=application/x-www-form-urlencoded then spaces are encoded as +. But the regex also appears to be looking for a literal '%' and then '20'. Why for? If the request is "multipart/form-data" it will have a space character in the data (which has a hex value of \x20 but that's not what the regex is looking for).</P><P></P><P>([%]20|[=]|[+])</P><P>[Ss][Ee][Ll][Ee][Cc][Tt]</P><P>([%]20|[+])</P><P>[^\r\n\x00-\x19\x7F-\xFF]+</P><P>([%]20|[+])</P><P>[Ff][Rr][Oo][Mm]</P><P>([%]20|[+])</P> Sun, 10 Mar 2019 10:56:43 GMT mhellman 2019-03-10T10:56:43Z https://community.cisco.com/t5/network-security/help-understanding-alarm-for-generic-sql-injection-in-http/m-p/858720#M84895 <P>I don't quite get the regex in 5474-1 shown below. The '+' I think I get; if the data is a GET or a POST with enctype=application/x-www-form-urlencoded then spaces are encoded as +. But the regex also appears to be looking for a literal '%' and then '20'. Why for? If the request is "multipart/form-data" it will have a space character in the data (which has a hex value of \x20 but that's not what the regex is looking for).</P><P></P><P>([%]20|[=]|[+])</P><P>[Ss][Ee][Ll][Ee][Cc][Tt]</P><P>([%]20|[+])</P><P>[^\r\n\x00-\x19\x7F-\xFF]+</P><P>([%]20|[+])</P><P>[Ff][Rr][Oo][Mm]</P><P>([%]20|[+])</P> Sun, 10 Mar 2019 10:56:43 GMT https://community.cisco.com/t5/network-security/help-understanding-alarm-for-generic-sql-injection-in-http/m-p/858720#M84895 mhellman 2019-03-10T10:56:43Z https://community.cisco.com/t5/network-security/help-understanding-alarm-for-generic-sql-injection-in-http/m-p/858721#M84896 <HTML><HEAD></HEAD><BODY><P>hmmm...upon further thought, this would be required for detecting SQL injection via GET method. So, I guess my question now is, what about via POST with enctype="multipart/form-data"?</P><P></P><P></P></BODY></HTML> Wed, 16 Jan 2008 23:25:13 GMT https://community.cisco.com/t5/network-security/help-understanding-alarm-for-generic-sql-injection-in-http/m-p/858721#M84896 mhellman 2008-01-16T23:25:13Z