Practically bypassing WEB Protection and SQL Injection rules of 360 website guard

During the test, the dongle intercepted the SQL query on the website where the dongle was used. However, the dongle was able to bypass the security and obtain the database information. For the protection device, if important information is obtained by the passer when it is enabled, I think it has been bypassed... the test procedure is as follows: bbs.siteserver.cn installed the url of the dongle request to execute the SQL statement: Modify the returned data packet: Obtain the query interface: run the SQL statement. The general statement is blocked. Modify the test statement. return package: the query result is returned. the dongle has not been intercepted... decrypts the password and enters the background. When the dongle is enabled, You can execute SQL queries to obtain information.Solution:Add Rules