SQL injection blocking users from posting

Hi,

You are blocked by the rule #209.
You could simply disable it, but I would not really recommend it, as it is an important rule. Also, if you allow your users to post images and links with HTML code, they will likely get blocked by another rule because it will look like some kind of XSS vulnerability.

Another solution is to use the .htninja file, which let you create your own custom rules.
For instance, you could whitelist a “POST” request with a “content” variable sent to the “/wp-admin/post.php” script.
The following code could be added to the htninja file:

<?php
/*
 +=============================================================+
 | NinjaFirewall optional configuration file                   |
 |                                                             |
 | See: http://ninjafirewall.com/wordpress/htninja/            |
 +=============================================================+
*/

// Allow $_POST['content'] sent to '/wp-admin/post.php':
if (! empty($_POST['content']) && strpos($_SERVER['SCRIPT_NAME'], '/wp-admin/post.php') !== FALSE ) {
   return 'ALLOW';
}

Also, you can run NinjaFirewall in debugging mode so that you can take your time to tweak its configuration without blocking your visitors: Testing NinjaFirewall without blocking your visitors

There must be something in your text that trigger the rule. That rule has never been changed since the very first release of NinjaFirewall.

Since you allow HTML code in your posts, consider using the .htninja file.