The rules are formatted much as conditionals in a C/Java/Perl-like language.

文字列Literals edit


'This string shouldn\'t fail' この文字列は途中にシングルクォーテーションマークがありますが、バックスラッシュがあるので失敗しません

You can specify a literal by placing it in single or double quotes (for strings), or by typing it in as-is (for numbers, both floating-point and integer). You can get linebreaks with \n, tab characters with \t, and you can also escape the quote character with a backslash.

"This is a string"
'This is also a string'
'This string shouldn\'t fail'
"This string\nHas a linebreak"

Variables edit

The abuse filter passes various variables by name into the parser. These variables can be accessed by typing their name in, in a place where a literal would work. You can view the variables associated with each request in the abuse log.


Action variable can be 'edit', 'move' or 'createaccount'. As of May 1, 2009, uploads seem to be completely ignored by Abuse Filter.

You can define more variables for ease of understanding with the assign symbol := in a line (closed by ;) within a condition. Example (from w:en:Special:AbuseFilter/79):

rcount(line1, removed_lines)) > (rcount(line1, added_lines))

All variables edit

Variable description Variable name Variable values
Edit count of user user_editcount
Name of user account user_name
Time email address was confirmed user_emailconfirm
Age of user account user_age in seconds; 0 for IP
Groups (including implicit) user is in user_groups
Page ID (found in the page's HTML source - search for wgArticleId) article_articleid this is 0 for new pages
Page namespace article_namespace
Page title (without namespace) article_text
Full page title article_prefixedtext
Edit protection level of the page article_restrictions_edit
Move protection level of the page article_restrictions_move
Last ten users to contribute to the page article_recent_contributors
Action action edit, move, createaccount, delete
Edit summary/reason summary
Whether or not the edit is marked as minor minor_edit
Old page wikitext, before the edit old_wikitext
New page wikitext, after the edit new_wikitext
Unified diff of changes made by edit edit_diff
New page size new_size
Old page size old_size
Size change in edit edit_delta
Lines added in edit added_lines
Lines removed in edit removed_lines
All external links in the new text all_links
Links in the page, before the edit old_links
All external links added in the edit added_links
All external links removed in the edit removed_links
Parsed HTML source of the new revision new_html
New page text, stripped of any markup new_text
Disabled old_html
Disabled old_text
Whether or not the change was made through a tor exit node tor_exit_node 0, 1
Unix timestamp of change timestamp

Page/Article Namespace edit

See also Manual:Namespace

English Wikipedia namespaces
Basic namespaces Talk namespaces
0 Main Talk 1
2 User User talk 3
4 Wikipedia Wikipedia talk 5
6 File File talk 7
8 MediaWiki MediaWiki talk 9
10 Template Template talk 11
12 Help Help talk 13
14 Category Category talk 15
100 Portal Portal talk 101
108 Book Book talk 109
Virtual namespaces
-1 Special
-2 Media

Simple comparisons edit

You can compare variables with other variables and literals with the following syntax:

  • < and > — Return true if the left-hand operand is less than/greater than the right-hand operand respectively.
  • <= and >= — Return true if the left-hand operand is less than or equal to/greater than or equal to the right-hand operand respectively.
  • == and != — Return true if the left-hand operand is equal to/not equal to the right-hand operand respectively.
Example Result
1 == 2 False
1 <= 2 True
1 >= 2 False
1 != 2 True
1 < 2 True
1 > 2 False

Arithmetic edit

You can use basic arithmetic symbols to do arithmetic on variables and literals with the following syntax:

  • - — Subtract the right-hand operand from the left-hand operand.
  • + — Add the right-hand operand to the left-hand operand.
  • * — Multiply the left-hand operand by the right-hand operand.
  • / — Divide the left-hand operand by the right-hand operand.
  • ** — Raise the left-hand operand to the exponential power specified by the right-hand operand.
  • % — Return the remainder given when the left-hand operand is divided by the right-hand operand.
Example Result
1 + 1 2
2 * 2 4
1 / 2 0.5
9 ** 2 81
6 % 5 1

Keywords edit

Two special keywords are included for often-used functionality

  • like returns true if the left-hand operand matches the glob pattern in the right-hand operand.
  • in returns true if the right-hand operand (a string) contains the left-hand operand.
  • rlike and regex return true if the left-hand operand matches (contains) the regex pattern in the right-hand operand. The system uses PCRE.
"1234" like "12?4"

Result: True

"1234" like "12*"

Result: True

"foo" in "foobar"

Result: True

"foo" regex "\w+"

Result: True

Functions edit

A number of built-in functions are included to ease some common issues. They are executed in the general format functionName(arg1,arg2,arg3), and can be used in place of any literal or variable. Its arguments can be given as literals, variables, or even other functions.

  • length returns the length of the string given as the first argument.
  • lcase returns the first argument converted to lower case.
  • ccnorm normalises confusable/similar characters in the argument, and returns a canonical form.
  • convert returns the second argument converted to variant language specified by the first argument. ONLY apply on wikis with LanguageConverter class. (New func added on rev:49399, need support of MediaWiki after rev:49397)
  • rmdoubles removes repeated characters in the argument, and returns the result.
  • rmwhitespace removes whitespace (spaces, tabs, newlines)
  • specialratio returns the number of non-alphanumeric characters divided by the total number of characters in the first argument.
  • rmspecials removes any special characters in the first argument, and returns the result.
  • norm is equivalent to rmwhitespace(rmspecials(rmdoubles(ccnorm(arg1)))).
  • count returns the number of times the needle (first string) appears in the haystack (second string). If only one argument is given, splits it by commas and returns the number of segments.

Result: 9


Result: wikipedia


Result: W1K1PED1A

convert("zh-hant", "维基百科") // assume we work on a wiki with Chinese LanguageConverter class

Result: 維基百科

rmdoubles( "foobybboo" )

Result: fobybo


Result: 0.1

norm( "!!ω..ɨ..ƙ..ɩ..ᑭᑭ..Ɛ.Ɖ@@l%%α!!" )

Result: W1K1PED1A

count( "foo", "foofooboofoo" )

Result: 3

count( "foo,bar,baz" )

Result: 3

rmspecials( "FOOBAR!!1" )

Result: FOOBAR1

Boolean operations edit

You can match if and only if all of a number of conditions are true, one of a number of conditions are true, or one and only one of all conditions are true.

  • x | y — OR – returns true if one or more of the conditions is true.
  • x & y — AND – returns true if both of the conditions are true.
  • x ^ y — XOR – returns true if one, and only one of the two conditions is true.
  • !x — NOT – returns true if the condition is not true.
1 | 1

Result: True

1 | 0

Result: True

0 | 0

Result: False

1 & 1

Result: True

1 & 0

Result: False

0 & 0

Result: False

1 ^ 1

Result: False

1 ^ 0

Result: True

0 ^ 0

Result: False


Result: False

Order of operations edit

Operations are generally done left-to-right, but there is an order to which they are resolved. As soon as the filter fails one of the conditions, it will stop checking the rest of them and move on to the next filter. The evaluation order is:

  1. Anything surrounded by parentheses (( and )) is evaluated as a single unit.
  2. Turning variables/literals into their respective data. (i.e., article_namespace to 0)
  3. Function calls (norm, lcase, etc.)
  4. Unary + and - (i.e. -1234, +1234)
  5. Keywords
  6. Boolean inversion (!x)
  7. Exponentiation (2**3 → 8)
  8. Multiplication-related (multiplication, division, modulo)
  9. Comparisons. (<, >, ==)
  10. Boolean operations. (&, |, ^, in)