rule test12 deny regex ".*FROM.*t1.*WHERE.*OR.*" on_queries select
users %@% match all rules test12