For more expressions to match items such as SQL queries and URIs, see your FortiWeb’s list of predefined data types. |
To match... | You can use... |
Line endings (platform-independent) | (\r\n)|\n|\r |
Any alphanumeric character (ASCII only; e.g. does not match é or É) | [a-zA-Z0-9] |
Specific domain name (e.g. www.example.com; case insensitive) | (?i)\bwww\.example\.com\b |
Any domain name (valid non-internationalized TLDs only; does not match domain names surrounded by letters or numbers) | (?i)\b.*\.(a(c|d|e(ro)?|f|g|i|m|n|o|q|r|s(ia)?|t|y|w|x|z)|b(a|b|d|e|f|g|h|i(z)?|j|m|n|o|r|s|t|v|w|y|z)|c(a(t)?|c|d|f|g|h|i|k|l|m|n|o((m)?(op)?)|r|s|u|v|x|y|z)|d(e|j|k|m|o|z)|e(c|du|e|g|h|r|s|t|u)|f(i|j|k|m|o|r)|g(a|b|d|e|f|g|h|i|l|m|n|ov|p|q|r|s|t|u|w|y)|h(k|m|n|r|t|u)|i(d|e|l|m|n(fo)?(t)?|o|q|r|s|t)|j(e|m|o(bs)?|p)|k(e|g|h|i|m|n|p|r|w|y|z)|l(a|b|c|i|k|r|s|t|u|vy)|m(a|c|d|e|g|h|il|k|l|m|n|o(bi)?|p|q|r|s|t|u(seum)?|v|w|x|y|z)|n(a(me)?|c|e(t)?|f|g|i|l|o|p|r|u|z)|o(m|rg)|p(a|e|f|g|h|k|l|m|n|r(o)?|s|t|w|y)|qa|r(e|o|s|u|w)|s(a|b|c|d|e|g|h|i|j|k|l|m|n|o|r|s|t|u|v|y|z)|t(c|d|el|f|g|h|j|k|l|m|n|o|p|r(avel)?|t|v|w|z)|u(a|g|k|s|y|z)|v(a|c|e|g|i|n|u)|w(f|s)|xxx|y(e|t|u)|z(a|m|w))\b |
Any domain name (valid internationalized TLDs in UTF-8 only; does not match ASCII-encoded DNS forms such as xn--fiqs8s) | (?i)\b.*\.(tél\b|中国|中國|日本|新加坡|ישראל|台灣|الجزائر|বাংলা|مصر|გე|香港|भारत|بھارت|భారత్|ભારત|ਭਾਰਤ|இந்தியா|ভারত|ایران|الاردن|қаз|مليسيا|المغرب|عمان|рф|پاکستان|срб|فلسطين|قطر|சிங்கப்பூர்|السعودية|한국|سوريا|ලංකා|இலங்கை|ไทย|تونس|укр|امارات|台湾|اليمن)\b |
Any sub-domain name | (?i)\b(.*)\.example\.com\b |
Specific IPv4 address | \b10\.1\.1\.1\b |
Any IPv4 address | \b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b |
Specific HTML tag (well-formed HTML only, e.g. <br> or <img src="1.gif" />; does not match the element’s contents between a tag pair; does not match the closing tag) | (?i)<\s*TAG\s*[^>]*> |
Specific HTML tag pair and contained text/tags, if any (well-formed HTML only; expression does not validate by DTD/Schema) | (?i)<\s*(TAG)\s*[^>]*>[^<]*</\1> |
Any HTML tag pair and contained text/tags, if any (well-formed HTML only; expression does not validate by DTD/Schema) | (?i)<\s*([A-Z][A-Z0-9]*)\b[^>]*>(.*?)</\1> |
Any HTML comment | (?:<|<)!--[\s\S]*?--[ \t\n\r]*(?:>|>) |
Any HTML entity (well-formed entities only; expression does not validate by DTD/Schema) | &(?i)(#((x([\dA-F]){1,5})|(104857[0-5]|10485[0-6]\d|1048[0-4]\d\d|104[0-7]\d{3}|10[0-3]\d{4}|0?\d{1,6}))|([A-Za-z\d.]{2,31})); |
JavaScript UI events (onClick(), onMouseOver(), etc.) | (?i):on(blur|c(hange|lick)|dblclick|focus|keypress|(key|mouse)(down|up)|(un)?load|mouse(move|o(ut|ver))|reset|s(elect|ubmit)) |
All parameters that follow a question mark or hash mark in the URL (e.g. #pageView or ?param1=valueA¶m2=valueB...; back-reference to this match does not include the question/hash mark itself) | [#\?](.*) |