rewrite a character with HTTP POST data

A stream profile and rule to enable it should work nicely to rewrite the post data in requests. You'll want to try to be very specific on when you rewrite the & as this is typically used as a delimiter for post data parameters. You might want to use something like this:

  
  when HTTP_REQUEST {    
    
      Disable the stream filter by default    
     STREAM::disable    
    
      Check if the request is a POST, with a content type of text, from the Jakarta user agent  
     if {[HTTP::method eq "POST" && [HTTP::header value Content-Type] contains "text" \  
        && [HTTP::header value "User-Agent"] contains "Jakarta-HttpComponents"}{  
    
         Match the literal string "&" and replace it with and  
        STREAM::expression {@&@and@}   
    
         Enable the stream filter for this request only    
        STREAM::enable    
     }    
  }     
  when STREAM_MATCHED {  
      This event is only included for debugging.  You should remove the event after testing is complete.  
     log local0. "[IP::client_addr]:[TCP::local_port]: matched: [STREAM::match]"    
  }   
  

You could use a similar approach for rewriting the and back to & if it does appear in responses. Again, you'd want to try to be very specific about when you're rewriting the content as 'and' is a very common string.

Aaron