some rule for scan and check xss sqli rce