PHP Mod_Security2 and POST/GET SQL from TextArea

I wanted a quicker way to run SQL on my application. I have a secure admin panel which I wanted to add a page that had a query window for quickly running queries mostly for debugging. I put together the one textarea form and posted the variable and I got a 500 internal server error. I finally figured out that it must be Mod_security that is not allowing the query via POST or GET. I post SELECT with no problems. I can post SELECT * with not problems. But as soon as I post SELECT * FROM i get the error.

Is there a way to limit Mod_security without completely enabling SQL Posts? I'm hesitant to just disable it entirely for one page out of the whole site that needs it.

It would be nice if there was a workaround to securely build my own SQL query window.

I think adding a directive



I'm using Cpanel. Can I just add this to my Mod Security addon config file manager? I see all the rules but nothing really looks like an apache config file. I assume mod sec config file is just included in the apache config file so the above code should work inside the mod sec config file, right?

I have modsec2 so I don't think i can override with htaccess and I was unsure if just adding to my apache config due to the order of directives. My only other option would be to edit the httpd.conf at post VirtualHost include.

Can someone please verify this for me?

Also, does the Location path start at the root web or my public_html/?

Hi
You could use other word for FROM in your query passed via Post, than, in the script replace that word with FROM.

I'm going to try that. I haven't had a chance until this week to go back to it. I've also got some things I can try to just keep that one script from using modsec but it requires an apache restart so I gotta do it after hours.

The FROM change may be best depending on how much of the string is compared. Thanks for your suggestions. I'm going to try it, if anything, just to see the rate of comparison.