/([^\w]on[a-z]{3,32}\s*[;\/]?=)/ms
10101
/<.{0,3}(script|form|iframe|base|button|entity|isindex|embed|source|object)/sm
10102
/(frames|parent|top|this|self|window)\s*\[\s*[^a-z]/sm
10103
/(&#x|%)+0*(60|3c)/sm
10104
/[^a-z](href|src|action)\s*=\s*['"`]?(?!http|\/)[^'"`]{12,}/sm
10105
/select\s+[\@\*]/sm
14002
/([^\x00-\x7f]+)/
10300
/(&#\s{2,8})/
10500
/\/(etc|bin|dev|sbin|usr)\/\w{3,32}/
15010
/\\x[0-9a-f]{2,8}\\x[0-9a-f]{2,8}\\x[0-9a-f]{2,8}/
13003
/\/\*\s*\d{3,6}\s*\*\//
14007
/(_defined_functions|shell_exec|system|eval|passthru|exec|call_user_func[_yar]*|mail|pcntl_|putenv|popen|proc_open|settimeout)(\s*\$|\s*\()/sm
16014
/o:\d+:\"[a-z][^\s]*?\":\d+/sm
12005
