## 一句话木马
base64_decode\(
\$_(GET|post|cookie|files|session|env|phplib|GLOBALS|SERVER)\[

## SQL注入
select.+(from|limit)
(?:(union(.*?)select))
sleep\((\s*)(\d*)(\s*)\)
benchmark\((.*)\,(.*)\)
(?:from\W+information_schema\W)
(?:(?:current_)user|database|schema|connection_id)\s*\(
into(\s+)+(?:dump|out)file\s*
group\s+by.+\(