Bitninja是否有sql注入误报？

Question

I'm trying to save some php code to have saved examples and code templates on a server I currently rent. The problem is when I send $ to the server, it saves it in the database, no problem. But when I query the data it tells me there's an sql injection and blocks the IP address where I queried the table. Funny thing is that my table has categories and the problem only occurs when I query "category_id=3", the other categories have no hickups showing me the data with $.
Overall, I realize how this could be a problem, but all my inputs are escaped and have special measures in special cases and all my queries are formed by the same functions.

I tried changing $ to &dollar ; to get around this problem so that in the event I forgot to escape something or I don't know, php wouldn't recognize it as a variable but the result is the same.
I really don't get why this could be a major issue with BitNinja when I save html entities in plain text.

I know I could save the codes in files, getting around the database or base64 the code and save it as such, but that's not the issue here.

Answer 1

Assuming you're using the WAF module, then yes, it does produce false positives (as would almost any WAF detection of SQL injections). In their blog entry about this they state:

Our WAF 2.0 module protects you against SQL injections.

In the official OWASP Core Ruleset we have a ruleset for this attack vector. This is an very general ruleset so if you need to use it you must be very careful. I suggest if you enable it, use it in log-only mode.

As Bill mentions in the comments, we would need to see the code and data, to determine whether this is a true false positive.