ASCII diagrams grounded in the README, docs, and PyPI page.

8.1 Transformation Pipeline

   SQL payload:  SELECT * FROM users WHERE id>=5
        │
        ▼
  ┌──────────────────┐   multi-char operators first (>= is ONE token)
  │ LEXER            │   assign UUID to every token
  │ lexer.py         │   preserve strings & comments
  └────────┬─────────┘
           ▼
  ┌──────────────────┐   walk tokens, track clause:
  │ CONTEXT TRACKER  │   SELECT → FROM → WHERE ...
  │ context.py       │   + nesting depth
  └────────┬─────────┘
           ▼
  ┌──────────────────┐   apply rules (by target_type + allowed_clauses)
  │ TRANSFORMER      │   reapplication protection (by UUID)
  │ transformer.py   │   deterministic output
  └────────┬─────────┘
           │  (complex/nested? →)  ┌──────────────────┐
           ├──────────────────────▶│ AST BUILDER      │
           │                       │ ast_builder.py   │
           │                       │ subquery/function│
           │◀──────────────────────│ handling         │
           ▼                       └──────────────────┘
    /*!50000sElEcT*//**/*/**//*!50000fRoM*//**/users/**//*!50000wHeRe*//**/id%3E%3D5

8.2 The Three Critical Fixes

  BUG 1  multi-char operators
    naive:  ">=" → "%3E" + "="  → "%3E="   ✗ broken SQL
    fixed:  ">=" is one token   → "%3E%3D"  ✓  (lex multi-char FIRST)

  BUG 2  position tracking
    naive:  "token at pos 10 = SELECT"
            wrap → "/*!50000SELECT*/"  → pos 10 now wrong  ✗
    fixed:  each token has a UUID that never changes         ✓

  BUG 3  context blindness
    naive:  encode every "="  → breaks SELECT list        ✗
            encode no  "="     → fails to bypass WHERE     ✗
    fixed:  track clause; encode in WHERE/HAVING only        ✓

8.3 Context-Aware Encoding (why clause matters)

   SELECT   *   FROM users   WHERE   id >= 5
   ──────   ─   ──── ─────   ─────   ──┬──
   SELECT clause              WHERE clause
      │                            │
   leave "*" alone            encode operator
   (not a WAF signature)      id%3E%3D5
                              (allowed_clauses=[WHERE])

8.4 Transformation Modules → Rules → Transformer

  CORE (v2.0.0)              ADVANCED (v2.1.0)
  ┌──────────────┐           ┌────────────────────────┐
  │ keyword_wrap │           │ homoglyph              │
  │ space_replace│           │ function_wrap          │
  │case_alternate│           │ numeric_obfuscation    │
  │ value_encode │           │ comment_chaos          │
  └──────┬───────┘           │ logical_operator_swap  │
         │                   │ hex_encode             │
         │                   │ version_comment_vary   │
         │                   └───────────┬────────────┘
         └──────────────┬────────────────┘
                        ▼  each exposes a TransformationRule
                ┌──────────────────┐
                │  SQLTransformer  │  add_rule(...) × N
                │  .transform(sql) │  → deterministic output
                └──────────────────┘

8.5 WAF Script Map

  WAF               Script              Key technique chain
  ───               ──────              ───────────────────
  Cloudflare        cloudflare2025.py   version comments · case · space
  AWS WAF v2        awswaf2026.py       hex encode · && / || · v50700
  Azure WAF         azurewaf2026.py     hex strings · comment chaos
  ModSecurity CRS   modsec_crs2026.py   case first · math numbers
  Imperva           imperva2026.py      homoglyphs · function wrap
  Akamai Kona       akamai2026.py       float numbers · enterprise
  ───────────────────────────────────────────────────────────────────
  Auto-select       meta_tamper.py      env-var driven chain combiner

  Usage:  sqlmap -u "https://target/?id=1" --tamper=cloudflare2025

8.6 Token-Based vs AST-Based (choose per query)

   ┌──────────────────────┐        ┌──────────────────────┐
   │ TOKEN-BASED          │        │ AST-BASED            │
   │ flat token stream    │        │ hierarchical tree    │
   │ + clause context     │        │ + subquery detection │
   │ faster · simpler     │        │ + function calls     │
   │ → most queries       │        │ → complex / nested   │
   └──────────────────────┘        └──────────────────────┘

   Repo-reported benchmarks:
     10 tokens   ~1 ms
     100 tokens  ~5 ms
     nested      ~10 ms
   → millisecond scale; the choice is accuracy, not speed.