Implement signature based method in WAF
<p>I wanna write a <a href="https://www.owasp.org/index.php/Web_Application_Firewall" rel="nofollow">WAF</a> which detects attacks with <code>signature-based</code> method. for example, for SQL injection, I collect a blacklist contains words such "select", "drop" and etc. when an attacker inputs these strings to query field, then the attack is detected.  Now, my question is how to separate these words from valid inputs that a regular user enters (such his username contains "select" word)? (Note that this is a <a href="https://www.owasp.org/index.php/Web_Application_Firewall" rel="nofollow">WAF</a> and I don't know what are the fields in the web app to check the best security and write a specific code for every field. I can just check common security and the rest must check by developers of the web app).</p>