---

SecRule ARGS "@rx (?i)(union\s+select|or\s+1\s*=\s*1|'\s*or\s*')\b" "id:1004,phase:2,block,msg:'DVWA SQL Injection Blocked',severity:CRITICAL"