The body test will remove the HTML tags, so that you are left with:
am Remmortgage
The second element in your test looks for "m.ortgage", which matches the "mmortgage" above.
[EMAIL PROTECTED] wrote:
Can anyone tell me why the following string:
<STRONG><COMMENT></COMMENT>am Rem<COMMENT>mortgage
Matches the following rule?
body AAA_MORTGAGE /m0rt|m.ortgage|Mort\sgage|m�³age/I
I made this rule while trying to block mortgage terms with high ascii in
them and it seems to have gone berzerk. It doesn't false positive anything
and the non-high ascii portions are working correctly but I cant figure out
how sa is interpreting this for the life of me.
