Allowed URL Characters

[eluser]JHackamack[/eluser]
What your seeing is only part of the query:

Code:

if ( ! preg_match("|^[".str_replace(array('\\-', '\-'), '-', preg_quote($this->config->item('permitted_uri_chars'), '-'))."]+$|i", $str))

The i at the end of the preg_match means its case insensitive and thus insert and INSERT are treated the same.