3/n
The above match and replace rule will replace all KKK in the request body to SQLi and XSS polyglot.

Say I use this :
'"><script src="somesrc"></script><h1>test
And put KKK in all fields. All fields will be replaced with this payload.

It will find trivial XSS and SQLi.