1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
|
[Ss][Ee][Ll][Ee][Cc][Tt][[:space:]]+.*[[:space:]]+[Ff][Rr][Oo][Mm][[:space:]]+.*\&[^_][^_]+
[Ww][Hh][Ee][Rr][Ee][[:space:]]+.*=.*\&[^_][^_]+
# DotNet SQL
exec[[:space:]]*sp_executesql
execute[[:space:]]*sp_executesql
exec[[:space:]]*sp_.*
execute[[:space:]]*sp_.*
exec[[:space:]]*xp_.*
execute[[:space:]]*sp_.*
exec[[:space:]]*@
execute[[:space:]]*@
executestatement[[:space:]]*\(
executeSQL[[:space:]]*\(
\.ExecuteSqlRaw[[:space:]]*\(
#setfilter
executeQuery[[:space:]]*\(
GetQueryResultInXML[[:space:]]*\(
#adodb
#sqloledb
#sql[[:space:]]*server
#driver
Server\.CreateObject
#\.Provider
\.Open([[:space:]]*\(|[[:space:]]+[\"\']).*
#ADODB.recordset
New[[:space:]]+OleDbConnection
ExecuteReader[[:space:]]*\(
#DataSource
SqlCo(mmand|nnection).*\=
#Microsoft.Jet
#SqlDataReader
#ExecuteReader
#GetString
#SqlDataAdapter
#CommandType
StoredProcedure[[:space:]]*\(
#System\.Data\.sql
[Cc]onnection[Ss]tr(ing)?[[:space:]]*\=[[:space:]]*[\'\"].*
# Stricter matching to avoid javascript spam
[\'\"][Ss][Ee][Ll][Ee][Cc][Tt][[:space:]]+.*(\{[A-Za-z0-9]+\}|[\'\"][[:space:]]+\+)
(WHERE|where)[[:space:]]+[^\;]+=.*(\{[A-Za-z0-9]+\}|[\'\"][[:space:]]+\+)
[\'\" ]+AND[[:space:]]+.*=.*(\{[A-Za-z0-9]+\}|[\'\"][[:space:]]+\+)
(LIKE|like)[[:space:]]+[^\(\)\;]+(\{[A-Za-z0-9]+\}|[\'\"][[:space:]]+\+)
(ORDER[[:space:]]+BY|order[[:space:]]+by)[[:space:]]+.*(\{[A-Za-z0-9]+\}|[\'\"][[:space:]]+\+)
(LIMIT|limit)[[:space:]]+.*(\{[A-Za-z0-9]+\}|[\'\"][[:space:]]+\+)
\.Raw[[:space:]]*\(.*\)
\.Exec[[:space:]]*\(.*\)
\.ExecContext[[:space:]]*\(.*\)
\.Query(Row(Context)?)?[[:space:]]*\(
#MongoDB rules
\.connect\(
\.createCollection\(
\.aggregate\(.*
\.find(One)?\(.*
\.insert(One|Many)?\(.*
\.delete(One|Many)?\(.*
\.update(One|Many)?\(.*
\.drop\(.*
#MySQL rules
\.createConnection\(.*
\.query\(.*\)
[Ss][Ee][Ll][Ee][Cc][Tt][[:space:]]+\${[^}]+
[Ff][Rr][Oo][Mm][[:space:]]+\${[^}]+
[Ii][Nn][Ss][Ee][Rr][Tt][[:space:]]+[Ii][Nn][Tt][Oo][[:space:]]+\${[^}]+
(UPDATE|update).+\${[^}]+
[Ll][Ii][Mm][Ii][Tt][[:space:]]+\${[^}]+
[Ww][Hh][Ee][Rr][Ee][[:space:]]+.*\${[^}]+
[Aa][Nn][Dd][[:space:]]+.*=[[:space:]]*\${[^}]+
[Ll][Ii][Kk][Ee][[:space:]]+['"]*\${[^}]+
(group|GROUP|order|ORDER)[[:space:]]+[Bb][Yy][[:space:]]+\${[^}]+
# PHP - Database
mysql_connect[[:space:]]*\(.*\$.*\)
mysql_pconnect[[:space:]]*\(.*\$.*\)
mysql_change_user[[:space:]]*\(.*\$.*\)
mysql_query[[:space:]]*\(.*\$.*\)
mysql_error[[:space:]]*\(.*\$.*\)
mysql_set_charset[[:space:]]*\(.*\$.*\)
mysql_unbuffered_query[[:space:]]*\(.*\$.*\)
mysqli_.*[[:space:]]*\(.*\$.*\)
pg_connect[[:space:]]*\(.*\$.*\)
pg_pconnect[[:space:]]*\(.*\$.*\)
pg_execute[[:space:]]*\(.*\$.*\)
pg_insert[[:space:]]*\(.*\$.*\)
pg_put_line[[:space:]]*\(.*\$.*\)
pg_query[[:space:]]*\(.*\$.*\)
pg_select[[:space:]]*\(.*\$.*\)
pg_send_query[[:space:]]*\(.*\$.*\)
pg_set_client_encoding[[:space:]]*\(.*\$.*\)
pg_update[[:space:]]*\(.*\$.*\)
sqlite_open[[:space:]]*\(.*\$.*\)
sqlite_poen[[:space:]]*\(.*\$.*\)
sqlite_query[[:space:]]*\(.*\$.*\)
sqlite_array_query[[:space:]]*\(.*\$.*\)
sqlite_create_function[[:space:]]*\(.*\$.*\)
sqlite_create_aggregate[[:space:]]*\(.*\$.*\)
sqlite_exec[[:space:]]*\(.*\$.*\)
sqlite_fetch_.*[[:space:]]*\(.*\$.*\)
msql_.*[[:space:]]*\(.*\$.*\)
mssql_.*[[:space:]]*\(.*\$.*\)
odbc_.*[[:space:]]*\(.*\$.*\)
fbsql_.*[[:space:]]*\(.*\$.*\)
sybase_.*[[:space:]]*\(.*\$.*\)
ibase_.*[[:space:]]*\(.*\$.*\)
dbx_.*[[:space:]]*\(.*\$.*\)
ingres_.*[[:space:]]*\(.*\$.*\)
ifx_.*[[:space:]]*\(.*\$.*\)
oci_.*[[:space:]]*\(.*\$.*\)
sqlsrv_.*[[:space:]]*\(.*\$.*\)
px_.*[[:space:]]*\(.*\$.*\)
ovrimos_.*[[:space:]]*\(.*\$.*\)
maxdb_.*[[:space:]]*\(.*\$.*\)
db2_.*[[:space:]]*\(.*\$.*\)
->sqliteCreate(Agregate|Collation|Function)[[:space:]]*\(
->create(Aggregate|Collation|Function)[[:space:]]*\(
querySingle[[:space:]]*\(
[A-Z]+::expr\(.*\$.*\)
[Ww][Hh][Ee][Rr][Ee][[:space:]]+.*=[[:space:]]*\{\}
[Aa][Nn][Dd][[:space:]]+.*=[[:space:]]*\{\}
[Ww][Hh][Ee][Rr][Ee][[:space:]]+.*=.*%s.*%[[:space:]]+[A-Za-z0-9]+
\.filter[[:space:]]*\([[:space:]]*text[[:space:]]*\([^\)]+%s
\.create_function[[:space:]]*\(
\.create_aggregate[[:space:]]*\(
\.create_collation[[:space:]]*\(
\.enable_load_extension[[:space:]]*\([[:space:]]*True
\.execute(many|script)?[[:space:]]*\(
\.iterdump[[:space:]]*\(
\.load_extension[[:space:]]*\(
\.set_authorizer[[:space:]]*\(
\.set_progress_handler[[:space:]]*\(
\.((destroy|delete|update|find)_(all|by)(_name|_sql)?|(re)?where|having|not)[[:space:]]*\([[:space:]]*["'].*\#\{
\.(from|group)[[:space:]]*\([^:\)]+:
\.(calculate|average|count|maximum|minimum|sum|join|lock|(re)?select)[[:space:]]*\(.*\[:
\.exists\?.*:
\.find_(or_(create|initialize)_)?by!?.*:
Arel\.sql\(.*["'].*#\{
conditions[[:space:]]*[:=>]+[[:space:]]*.*\#\{[^\}]+\}
\.where[[:space:]]*\([[:space:]]*['"].*['"][[:space:]]*\+
(WHERE|where)[[:space:]]+.*=.*[\'\"][[:space:]]*\+.*
[\'\" ]+AND[[:space:]]+.*=.*\+.*
(LIKE|like)[[:space:]]+[^\;]+\+.*
(ORDER[[:space:]]+BY|order[[:space:]]+by)[[:space:]]+.*\+.*
(LIMIT|limit)[[:space:]]+([0-9]+,[[:space:]]*.*)
|
