SQL Injection Signal Regex

Security

Regular expression

/(union\s+select|or\s+1=1|--|;\s*drop)/

Pattern breakdown

Part	Meaning
`Anchor or context`	Use anchors when you need whole-string validation.
`Main token`	The core token sequence describes the accepted text shape.
`Character class`	Character classes limit which characters are valid.
`Quantifier`	Quantifiers control how many characters or groups are accepted.
`Flags`	Use language-specific flags such as i, m, or u only when needed.

Should match

OR 1=1 --
OR1=1--

Should not match

normal search
not matching sample
OR 1=1 -- invalid
normal searchOR 1=1 --

Test cases

Input	Expected	Why it matters
`OR 1=1 --`	Match	Representative valid input for this pattern.
`OR1=1--`	Match	Representative valid input for this pattern.
`normal search`	No match	Common invalid or boundary input.
`(empty string)`	No match	Common invalid or boundary input.
`not matching sample`	No match	Common invalid or boundary input.
`OR 1=1 -- invalid`	No match	Common invalid or boundary input.
`normal searchOR 1=1 --`	No match	Common invalid or boundary input.

JavaScript

const re = /(union\s+select|or\s+1=1|--|;\s*drop)/;
re.test(input);

Python

import re
bool(re.search(r"(union\s+select|or\s+1=1|--|;\s*drop)", text))

PHP

$ok = preg_match('/(union\s+select|or\s+1=1|--|;\s*drop)/', $value) === 1;

Java

Pattern pattern = Pattern.compile("(union\\s+select|or\\s+1=1|--|;\\s*drop)");
pattern.matcher(value).find();

Go

re := regexp.MustCompile(`(union\s+select|or\s+1=1|--|;\s*drop)`)
ok := re.MatchString(value)

Notes and production use

SQL Injection Signal regex is useful as a practical starting point. Test it against your real input, avoid using it as the only security control, and prefer a parser when the format has complex grammar.

Performance tip: avoid running complex regular expressions repeatedly on very large untrusted strings without limits. Prefer anchored validation patterns, cap input length before matching, and use a parser when the target format has nested grammar.

SQL Injection Signal