we had one a while back where a small number of requests were failing for a particular set of pages. We first spotted that all the urls contained 'select' (gene

we had one a while back where a small number of requests were failing for a particular set of pages. We first spotted that all the urls contained 'select' (generally as part of a parameter name, like itemselect), so I went digging for WAF-like filters anywhere in the stack. I found that we had some ancient config in a proxy server from before we used a commercial waf that looked for `SELECT.*UNION` ... flicked back to the URLs and found they'd all also all had a parameter like 'company=credit+union'. Facepalm, and ripped the code out, we had plenty of protection elsewhere