WAF and HIPS detect SQL injection based on rules.
1" OR 1=1 --
Both devices will block it.
How about `1" OR 300+1-300+0=50+57-6 -- ?
In my scenario HIPS doesn't seem to be able detect SQL injection inputted in form fields but yet able to detect SQL injection passed in URLs.
WAF should be able to detect both types of SQL injection.
Is it because URLs and form fields are on different layers? HIPS is on network layer whereas WAF is on application layer that's why able to detect both form based and url injection or because the 300+1-300 query doesn't match the rule.
So question is can HIPS actually detect Form based SQL injection? If no why? If yes I would assume it's the HIPS inability or misconfiguration.