alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SQL Injection"; content:"1' and '1'='1'"; nocase; sid:3000001; rev:1;)