How I bypassed Cloudflare's SQL Injection filter
Cloudflare's and all other "Webapp Firewalls" are just snake oil. They can't know what transformations are done server-side on untrusted input, so you'll always (with enough time and determination) be able to craft a string that passes the WAF but exploits the backend.<p>Just a few examples: <a href="https://github.com/frizb/Bypassing-Web-Application-Firewalls" rel="nofollow">https://github.com/frizb/Bypassing-Web-Application-Firewalls</a>