I'm seeing this in our logs:
2.59.254.136 - - [06/Oct/2023:16:05:29 -0400] "GET /ubbthreads/ubbthreads.php?ubb=showflat%27%29%29%29%2F%2A%2A%2FaNd%2F%2A%2A%2F8301%2F%2A%2A%2FBeTWEEn%2F%2A%2A%2F%28sELEcT%2F%2A%2A%2FaNd%2F%2A%2A%2F%28sELEcT%28CAsE%2F%2A%2A%2FwhEN%2F%2A%2A%2F%288301%3D8301%29%2F%2A%2A%2FthEn%2F%2A%2A%2F8301%2F%2A%2A%2FelSe%2F%2A%2A%2F%28sELEcT%2F%2A%2A%2F1586%2F%2A%2A%2FuniON%2F%2A%2A%2FsELEcT%2F%2A%2A%2F2377%29%2F%2A%2A%2FenD%29%29--%2F%2A%2A%2Fpkgf&Board=1&Number=407581&Searchpage=3&Main=56047&Words=4%20barrel%20carb&topic=0&Search=true HTTP/1.1" 200 3206 "https://www.stovebolt.com/ubbthreads/ubbthreads.php" "Opera/9.01 (Windows NT 5.1; U; ru)"
2.59.254.136 - - [06/Oct/2023:16:05:31 -0400] "GET /ubbthreads/ubbthreads.php?ubb=showflat%%27%2F%2A%2A%2FAnd%2F%2A%2A%2F2508%2F%2A%2A%2FbetWEEn%2F%2A%2A%2F%28SELeCt%2F%2A%2A%2FAnd%2F%2A%2A%2F%28SELeCt%28CasE%2F%2A%2A%2FWHEn%2F%2A%2A%2F%282508%3D4408%29%2F%2A%2A%2FtHen%2F%2A%2A%2F2508%2F%2A%2A%2FElsE%2F%2A%2A%2F%28SELeCt%2F%2A%2A%2F4408%2F%2A%2A%2FuniON%2F%2A%2A%2FSELeCt%2F%2A%2A%2F5903%29%2F%2A%2A%2FENd%29%29--%2F%2A%2A%2FBkhs&Board=1&Number=407581&Searchpage=3&Main=56047&Words=4%20barrel%20carb&topic=0&Search=true HTTP/1.1" 200 3203 "https://www.stovebolt.com/ubbthreads/ubbthreads.php" "Opera/9.01 (Windows NT 5.1; U; ru)"
Here's what it looks like decoded:
2.59.254.136 - - [06/Oct/2023:16:05:29 -0400] "GET /ubbthreads/ubbthreads.php?ubb=showflat')))/**/aNd/**/8301/**/BeTWEEn/**/(sELEcT/**/aNd/**/(sELEcT(CAsE/**/whEN/**/(8301=8301)/**/thEn/**/8301/**/elSe/**/(sELEcT/**/1586/**/uniON/**/sELEcT/**/2377)/**/enD))--/**/pkgf&Board=1&Number=407581&Searchpage=3&Main=56047&Words=4 barrel carb&topic=0&Search=true HTTP/1.1" 200 3206 "https://www.stovebolt.com/ubbthreads/ubbthreads.php" "Opera/9.01 (Windows NT 5.1; U; ru)"
2.59.254.136 - - [06/Oct/2023:16:05:31 -0400] "GET /ubbthreads/ubbthreads.php?ubb=showflat%'/**/And/**/2508/**/betWEEn/**/(SELeCt/**/And/**/(SELeCt(CasE/**/WHEn/**/(2508=4408)/**/tHen/**/2508/**/ElsE/**/(SELeCt/**/4408/**/uniON/**/SELeCt/**/5903)/**/ENd))--/**/Bkhs&Board=1&Number=407581&Searchpage=3&Main=56047&Words=4 barrel carb&topic=0&Search=true HTTP/1.1" 200 3203 "https://www.stovebolt.com/ubbthreads/ubbthreads.php" "Opera/9.01 (Windows NT 5.1; U; ru)"
Would there ever be a legitimate reason to have a select in the query string? I ask because if not, I'm going to block it in the .htacess file.
