How I bypassed Cloudflare's SQL Injection filter
Cloudflare's and all other "Webapp Firewalls" are just snake oil. They can't know what transformations are done server-side on untrusted input, so you'll always (with enough time and determination) be able to craft a string that passes the WAF but exploits the backend.Just a few examples: https://github.com/frizb/Bypassing-Web-Application-Firewalls