Check any request (get or post) for some chars?

I wanted to check any GET or POST for some chars say %3C and %3E (< and >).

 

 

GET I think would be covered by checking the contents of HTTP::uri but this doesn't do anything to interpret POST data.

 

 

I've tried some stuff like:

 

 

when HTTP_REQUEST_DATA {

 

if { ( [HTTP::payload] contains "%3C") && ( [HTTP::payload] contains "%3E) } {

 

do something

 

}

 

}

 

 

but it does not seem to be working when I do a curl post containing both of those chars so I am clearly doing something wrong? Any suggestions.

 

 

Thanks,

 

Patrick