Mitch,
Sorry to have taken so long to reply, but I just noticed my notification email. Let me first say that I can understand your frustration. It can be very frustrating trying to get the correct filter in place. In the examples you list none would catch this statement:
UPDATE
table_stuff
SET a = b
My best suggestion for your situation would be to be liberal with your use of the wildcard (%). You could have some spaces before the code or extra spaces between so I'd recommend something like this:
%update%table_stuff%
Which should capture any possible combination of spaces.
Through a little testing it also appears (I don't know for sure) that the filter on textdata may be case sensitive as well. Looking for confirmation.
Jack Corbett
Consultant - Straight Path Solutions
Check out these links on how to get faster and more accurate answers:
Forum Etiquette: How to post data/code on a forum to get the best help
Need an Answer? Actually, No ... You Need a Question