regexp output filtering

Hi,
I would like to filter the output content on a regexp base to avoid
confidential data to be sent to the user. For instance, if the data
contains "password is ...", replace it by "data not available". It can
be used too to prevent a hacker to obtain system informations via sql
injection for instance.
I've read about mod_ext_filter, but it's not suitable for performances
issues.
I'd like to use something like SetOutputFilter but don't know how to
set up a suitable filter.
Redirecting to a specific page would be nice too.

 > I would like to filter the output content on a regexp base to avoid
 > confidential data to be sent to the user. For instance, if the data
 > contains "password is ...", replace it by "data not available". It can
 > be used too to prevent a hacker to obtain system informations via sql
 > injection for instance.
 > I've read about mod_ext_filter, but it's not suitable for performances
 > issues.
 > I'd like to use something like SetOutputFilter but don't know how to
 > set up a suitable filter.
 > Redirecting to a specific page would be nice too.

you want to look at ivan ristic's excellent mod_security. afaik it
does not allow to substitute stuff, but redirecting, throwing an error
or even shoot back at the culprit (bad idea, btw. for various reasons)
is possible. also you could also use it to prevent the sql-injection
before it takes place.

joachim<!-- ~MESSAGE_AFTER~ -->