Module decode 

Normalization before matching: what an attacker encodes, the WAF decodes. Every loop here is bounded by its input (fuzzed).

Constants

MAX_VALUE

The most of one value that is looked at.

Functions

html_entities

Named entities that matter for markup and scripts, and numeric ones (<, <, with or without the ;).

js_escapes

\xHH and \uHHHH.

normalize

Decode a value the way a browser, a server or a database might read it: percent-encoding (twice, for double encoding; %uXXXX too), HTML entities, \xHH / \uXXXX escapes; then NUL and control characters removed, SQL /* comments */ turned into spaces, lower-cased, runs of whitespace collapsed.

percent_decode

%HH and %uHHHH; + is left alone (query values were form-decoded).

strip_sql_comments

/* … */ (and MySQL’s /*! … */) become a space: un/**/ion → un ion stays harmless, union/**/select → union select is caught.