OWASP security and drupal Recently, To improve our site security we implemented and enabled OWASP security in our server using mod_security.

After we enabled the OWASP security, whenever I try to create or edit contents in my site after logging in as admin, It is showing it as SQL INJECTION and it does not allow to crate or edit new node. 

When I edit content it redirects me to "/node/1078/edit"  and then it shows error 

"Error
The website encountered an unexpected error. Please try again later."


I also tried to find solution here but so far nothing helps. We have used drupal database API for all our database operations. I am not sure why OWASP is showing "SQL INJECTION". 

How can I fix this?
It would appear that OWASP think your site is vulnerable to SQL injection. You'll need to find the exact reason yourself (it requires debugging with the site in front of you), but here are some pointers:


Make sure your core version is >=7.32. There was a massive SQL hole in Drupal before that update.
Once that's confirmed, start disabling custom and contrib modules one-by-one, checking the edit form each time. If one of those is to blame, that simple process will find it. If you find a contrib module that's to blame, be sure to open a bug report on Drupal.org.
If your Drupal core version is up to date, and none of the custom/contrib modules are responsible, you'll need to contact OWASP to ask them for their criteria, and how they've arrived at the conclusion that your site is vulnerable.
On the off-chance they respond by pointing out another SQL injection vulnerability in Drupal core (very, very unlikely), be sure to report it to the security team. Same thing for contrib modules (more likely).