title: What does ARGS , ARGS_NAMES actually mean in mod_security crs?
body: <p>What does ARGS , ARGS_NAMES actually mean in mod_security core rule sets?</p>
  
  <p>I have already referred to the <a href="http://www.modsecurity.org/documentation/modsecurity-apache/2.1.2/modsecurity2-apache-reference.html#N1061E" rel="nofollow">Modsecurity2 Apache Reference</a> but I didnt get any clear idea.</p>
  
  <p>Can someone give me a specific idea , preferably with an explanation, what it actually is and how something actually triggers a rule positive like the one below.</p>
  
  <p>The rule below is triggered positive for cases like " x and 6" etc, in general any "and" followed by a digit. I understand what the request filename is, in this case. what i dont understand is what are ARGS and ARGS_NAMES. I need a specific example with reference to the rule below. </p>
  
  <pre><code>SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "(?i)\b(?i:and)\b\s+(\d{1,10}|'[^=]{1,10}')\s*[=]|\b(?i:and)\b\s+(\d{1,10}|'[^=]{1,10}')\s*[&lt;&gt;]|\band\b ?(?:\d{1,10}|[\'\"][^=]{1,10}[\'\"]) ?[=&lt;&gt;]+|\b(?i:and)\b\s+(\d{1,10}|'[^=]{1,10}')" \
      "phase:2,rev:'2.2.5',capture,t:none,t:urlDecodeUni,ctl:auditLogParts=+E,block,msg:'SQL Injection Attack',id:'959072',tag:'WEB_ATTACK/SQL_INJECTION',tag:'WASCTC/WASC-19',tag:'OWASP_TOP_10/A1',tag:'OWASP_AppSensor/CIE1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score},setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/SQL_INJECTION-%{matched_var_name}=%{tx.0}"
  </code></pre>