php - Detecting potential SQL injection attacks, as well as other security issues

We all know it is nearly impossible to produce a large website without one or two flaws. As such I've written a small monitor that checks Apache access logs for potential SQL injection attacks (amongst other things), and it's working very well. I get an alert whenever someone attempts an attack, and I've had so few false positives that the default action is now to dump them into an iptables drop list. It's even helped me identify a few (non-security) bugs and remove them.

Here's my rules (case insensitive):

PathInjection = \./\.\./(bin|boot|data|dev|etc|home|lib|lib64|media|mnt|opt|proc|root|sbin|selinux|srv|sys|tmp|usr|var)/


Havij = 0x31303235343830303536

r3dm0v3 = 0x7233646D3076335F68766A5F696E6A656374696F6E

LogicBypass = '.*?(\bor|\band|\bxor|\|\||\&\&).*?--

UnionSelect = union[^a-z-_]+((all|distinct)[^a-z-_]+)?select[^a-z-_]

What I'd like to know is, how would you bypass these checks and still produce a valid injection? Can you think of a way to improve them without introducing false positives?

A few notes:

• Case sensitivity is switched off.


• I'm using MySQL.


• The Havij and r3dm0v3 entries are used as a catch-all to prevent use of those automation tools.


• I'm checking both raw and urldecoded strings.


• I'm not looking for answers like "make more secure code instead".


• I'm not looking for a different way to do this, just a way to improve my current logic.

EDIT:
Ok, so people seem to have misunderstood my intent. That's probably my fault, since I didn't fully explain. This is being requested as a tacked-on feature to a monitoring product, and is designed to offer minimal security monitoring. As part of our dialog with the client and our documentation, we're emphasising that this is not a catch-all, nor is it a replacement for proper security infrastructure (e.g. an IDS and firewall). It's simply an informational service to help provide basic threat detection and produce statistics about the number of potential attacks. I'm not trying to write an IDS or firewall. If it were up to me, I'd leave the feature out and tell them to go install a full suite of security infrastructure with its own monitoring systems, but this isn't my call. The current situation is that I've been testing the system on my own site. Right now, I'm just looking for a way to improve the regex strings to make this more effective. Hopefully this clears things up a little.

Answer

You're talking about writing an IDS. Unless your product is an IDS, just get and install one. Snort is well-known and has a free version.

I'm not looking for a different way to do this, just a way to improve my current logic.

Sometimes when it comes to security, the wrong approach simply is. How would I mess with your current logic? Unicode or hex encoding.