Eisodos FW SQL Parser
The parser sets the sql* parameters (row values, counters, paging) while it renders a <%SQL%…%SQL%> block, and reads EnableInlineSQL and LastSQLError. A visitor must not set them, so src/.blacklisted-params lists sql*, enableinlinesql and lastsqlerror, and Eisodos drops these names from GET, POST and cookies. If an app needs such a request parameter after all, it allows it with an exact-name rule in its .params file (e.g. input;SQLFILTER).