In 3 ^ is the first character of the regex, just as it is in 1 and
2. It
is also inside the delimiters, just like 1 and 2. In example 3 @ is
being used as a delimiter, and ^ is the first character after it.
Are you saying that in URIs, any character (@ in this case) can serve
as the delimiter, so long as it displays after the m and again at the
end of the entry?
I'm beginning to realize how many of my learning curve issues are
attempts to understand the very structure of a system created with a
bare minimum of structure.
There is definitely a VERY significant performance penalty to using
rawbody over URI, for any rule.
Consider the size of input. A rawbody regex must be run against the
entire text of the body after QP decoding. A uri regex must be run
against all the text of the URIs that SA found. There is likely to
be at
least a 100:1 difference in size of input. There's no "penalty" for
using a uri rule, as SA will always extract all the URIs and build the
input text, even if you aren't using it.
Great information Matt, thanks.
Dan
