✏ EDIT: 942360.ra

##! Please refer to the documentation at
##! https://coreruleset.org/docs/development/regex_assembly/.

##!+ i

\balter\s+char\b\s*\(?
\balter\s+group_concat\b\s*\(?
\balter\s+load_file\b\s*\(?
\bcreate\s+char\b\s*\(?
\bcreate\s+group_concat\b\s*\(?
\bcreate\s+load_file\b\s*\(?
\bdelete\s+char\b\s*\(?
\bdelete\s+group_concat\b\s*\(?
\bdelete\s+load_file\b\s*\(?
\bdesc\s+char\b\s*\(?
\bdesc\s+group_concat\b\s*\(?
\bdesc\s+load_file\b\s*\(?
\binsert\s+char\b\s*\(?
\binsert\s+group_concat\b\s*\(?
\binsert\s+load_file\b\s*\(?
\bload\s+char\b\s*\(?
\bload\s+group_concat\b\s*\(?
\bload\s+load_file\b\s*\(?
\brename\s+char\b\s*\(?
\brename\s+group_concat\b\s*\(?
\brename\s+load_file\b\s*\(?
\bselect\s+char\b\s*\(?
\bselect\s+group_concat\b\s*\(?
\bselect\s+load_file\b\s*\(?
\btruncate\s+char\b\s*\(?
\btruncate\s+group_concat\b\s*\(?
\btruncate\s+load_file\b\s*\(?
\bupdate\s+char\b\s*\(?
\bupdate\s+group_concat\b\s*\(?
\bupdate\s+load_file\b\s*\(?
\bend\s*?\);
[\s(]load_file\s*?\(
[\"'`]\s+regexp\W
[\"'`\w]\s+as\b\s*[\"'`\w]+\s*\bfrom
^[\W\d]+\s*?create\s+\w+
^[\W\d]+\s*?delete\s+\w+
^[\W\d]+\s*?desc\s+\w+
^[\W\d]+\s*?drop\s+\w+
^[\W\d]+\s*?insert\s+\w+
^[\W\d]+\s*?load\s+\w+
^[\W\d]+\s*?rename\s+\w+
^[\W\d]+\s*?select\s+\w+
^[\W\d]+\s*?truncate\s+\w+
^[\W\d]+\s*?update\s+\w+
^[\W\d]+\s*?alter\s*aggregate\b
^[\W\d]+\s*?alter\s*application\s*role\b
^[\W\d]+\s*?alter\s*assembly\b
^[\W\d]+\s*?alter\s*asymmetric\s*key\b
^[\W\d]+\s*?alter\s*audit\b
^[\W\d]+\s*?alter\s*authorization\b
^[\W\d]+\s*?alter\s*availability\s*group\b
^[\W\d]+\s*?alter\s*broker\s*priority\b
^[\W\d]+\s*?alter\s*bufferpool\b
^[\W\d]+\s*?alter\s*certificate\b
^[\W\d]+\s*?alter\s*cluster\b
^[\W\d]+\s*?alter\s*collation\b
^[\W\d]+\s*?alter\s*column\b
^[\W\d]+\s*?alter\s*conversion\b
^[\W\d]+\s*?alter\s*credential\b
^[\W\d]+\s*?alter\s*cryptographic\s*provider\b
^[\W\d]+\s*?alter\s*database\b
^[\W\d]+\s*?alter\s*default\b
^[\W\d]+\s*?alter\s*dimension\b
^[\W\d]+\s*?alter\s*diskgroup\b
^[\W\d]+\s*?alter\s*domain\b
^[\W\d]+\s*?alter\s*endpoint\b
^[\W\d]+\s*?alter\s*extension\b
^[\W\d]+\s*?alter\s*external\b
^[\W\d]+\s*?alter\s*event\b
^[\W\d]+\s*?alter\s*flashback\b
^[\W\d]+\s*?alter\s*foreign\b
^[\W\d]+\s*?alter\s*fulltext\b
^[\W\d]+\s*?alter\s*function\b
^[\W\d]+\s*?alter\s*hierarchy\b
^[\W\d]+\s*?alter\s*group\b
^[\W\d]+\s*?alter\s*histogram\b
^[\W\d]+\s*?alter\s*index\b
^[\W\d]+\s*?alter\s*indextype\b
^[\W\d]+\s*?alter\s*inmemory\b
^[\W\d]+\s*?alter\s*instance\b
^[\W\d]+\s*?alter\s*java\b
^[\W\d]+\s*?alter\s*language\b
^[\W\d]+\s*?alter\s*large\b
^[\W\d]+\s*?alter\s*library\b
^[\W\d]+\s*?alter\s*lockdown\b
^[\W\d]+\s*?alter\s*logfile\s*group\b
^[\W\d]+\s*?alter\s*login\b
^[\W\d]+\s*?alter\s*mask\b
^[\W\d]+\s*?alter\s*master\s*key\b
^[\W\d]+\s*?alter\s*materialized\b
^[\W\d]+\s*?alter\s*message\s*type\b
^[\W\d]+\s*?alter\s*method\b
^[\W\d]+\s*?alter\s*module\b
^[\W\d]+\s*?alter\s*nickname\b
^[\W\d]+\s*?alter\s*operator\b
^[\W\d]+\s*?alter\s*outline\b
^[\W\d]+\s*?alter\s*package\b
^[\W\d]+\s*?alter\s*partition\b
^[\W\d]+\s*?alter\s*permission\b
^[\W\d]+\s*?alter\s*procedure\b
^[\W\d]+\s*?alter\s*profile\b
^[\W\d]+\s*?alter\s*queue\b
^[\W\d]+\s*?alter\s*remote\b
^[\W\d]+\s*?alter\s*resource\b
^[\W\d]+\s*?alter\s*role\b
^[\W\d]+\s*?alter\s*rollback\b
^[\W\d]+\s*?alter\s*route\b
^[\W\d]+\s*?alter\s*schema\b
^[\W\d]+\s*?alter\s*search\b
^[\W\d]+\s*?alter\s*security\b
^[\W\d]+\s*?alter\s*server\b
^[\W\d]+\s*?alter\s*service\b
^[\W\d]+\s*?alter\s*sequence\b
^[\W\d]+\s*?alter\s*session\b
^[\W\d]+\s*?alter\s*symmetric\s*key\b
^[\W\d]+\s*?alter\s*synonym\b
^[\W\d]+\s*?alter\s*stogroup\b
^[\W\d]+\s*?alter\s*table\b
^[\W\d]+\s*?alter\s*tablespace\b
^[\W\d]+\s*?alter\s*text\b
^[\W\d]+\s*?alter\s*threshold\b
^[\W\d]+\s*?alter\s*trigger\b
^[\W\d]+\s*?alter\s*trusted\b
^[\W\d]+\s*?alter\s*type\b
^[\W\d]+\s*?alter\s*usage\b
^[\W\d]+\s*?alter\s*user\b
^[\W\d]+\s*?alter\s*view\b
^[\W\d]+\s*?alter\s*work\b
^[\W\d]+\s*?alter\s*workload\b
^[\W\d]+\s*?alter\s*wrapper\b
^[\W\d]+\s*?alter\s*xml\s*schema\b
^[\W\d]+\s*?alter\s*xsrobject\b
^[\W\d]+\s*?union\s*all\b
^[\W\d]+\s*?union\s*select\b
^[\W\d]+\s*?union\s*distinct\b

[✗] CANCEL