[
    [1, "\\.\\./\\.\\./", "目录保护1", 0],
    [1, "(?:etc\\/\\W*passwd)", "目录保护3", 0],
    [1, "(gopher|doc|php|glob|^file|phar|zlib|ftp|ldap|dict|ogg|data)\\:\\/", "PHP流协议过滤1", 0],
    [1, "base64_decode\\(", "一句话木马过滤3", 0],
    [1, "(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|char|chr|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\(", "一句话木马过滤4", 0],
    [1, "\\$_(GET|post|cookie|files|session|env|phplib|GLOBALS|SERVER)\\[", "一句话木马过滤5", 0],
    [1, "\\s+(or|xor|and)\\s+.*(=|<|>|'|\")", "SQL注入过滤1", 0],
    [1, "select.+(from|limit)", "SQL注入过滤2", 0],
    [1, "(?:(union(.*?)select))", "SQL注入过滤3", 0],
    [1, "sleep\\((\\s*)(\\d*)(\\s*)\\)", "SQL注入过滤5", 0],
    [1, "benchmark\\((.*)\\,(.*)\\)", "SQL注入过滤6", 0],
    [1, "(?:from\\W+information_schema\\W)", "SQL注入过滤7", 0],
    [1, "(?:(?:current_)user|database|concat|extractvalue|polygon|updatexml|geometrycollection|schema|multipoint|multipolygon|connection_id|linestring|multilinestring|exp|right|sleep|group_concat|load_file|benchmark|file_put_contents|urldecode|system|file_get_contents|select|substring|substr|fopen|popen|phpinfo|user|alert|scandir|shell_exec|eval|execute|concat_ws|strcmp|right)\\s*\\(", "SQL注入过滤8", 0],
    [1, "into(\\s+)+(?:dump|out)file\\s*", "SQL注入过滤9", 0],
    [1, "group\\s+by.+\\(", "SQL注入过滤10", 0],
    [1, "(invokefunction|call_user_func_array|\\\\think\\\\)", "ThinkPHP payload封堵", 0],
    [1, "^url_array\\[.*\\]$", "Metinfo6.x XSS漏洞", 0],
    [1, "(extractvalue\\(|concat\\(0x|user\\(\\)|substring\\(|count\\(\\*\\)|substring\\(hex\\(|updatexml\\()", "SQL报错注入过滤01", 0],
    [1, "(@@version|load_file\\(|NAME_CONST\\(|exp\\(\\~|floor\\(rand\\(|geometrycollection\\(|multipoint\\(|polygon\\(|multipolygon\\(|linestring\\(|multilinestring\\()", "SQL报错注入过滤02", 0],
    [1, "(substr\\()", "SQL注入过滤10", 0],
    [1, "(ORD\\(|MID\\(|IFNULL\\(|CAST\\(|CHAR\\()", "SQL注入过滤1", 0],
    [1, "(EXISTS\\(|SELECT\\#|\\(SELECT)", "SQL注入过滤1", 0],
    [1, "(bin\\(|ascii\\(|benchmark\\(|concat_ws\\(|group_concat\\(|strcmp\\(|left\\(|datadir\\(|greatest\\()", "SQL报错注入过滤01", 0],
    [1, "(?:from.+?information_schema.+?)", "", 0],
    [1, "(array_map\\(\"ass)", "菜刀流量过滤", 0]
]