diff --git a/internal/apps/agent/nginx/waf_runtime.lua b/internal/apps/agent/nginx/waf_runtime.lua
index 4759dc8d..e5586891 100644
--- a/internal/apps/agent/nginx/waf_runtime.lua
+++ b/internal/apps/agent/nginx/waf_runtime.lua
@@ -502,7 +502,8 @@ local file_inclusion_patterns = {
 local sql_patterns = {
     "union select", " or 1=1", "' or '", "\" or \"", "sleep(", "benchmark(",
     "information_schema", "xp_cmdshell", "load_file(", " into outfile",
-    "/*", "*/", "@@version",
+    -- Avoid bare "/*" / "*/": they match normal Accept: */* headers.
+    "/**/", "/*!", "*/--", "@@version",
 }
 local command_patterns = {
     ";wget", ";curl", "|bash", "|sh", "`id`", "$(id)", "&&", "||",
diff --git a/internal/apps/agent/nginx/waf_runtime_spec.lua b/internal/apps/agent/nginx/waf_runtime_spec.lua
index 940aa249..5a28ff7a 100644
--- a/internal/apps/agent/nginx/waf_runtime_spec.lua
+++ b/internal/apps/agent/nginx/waf_runtime_spec.lua
@@ -717,6 +717,14 @@ local function test_security_check_path_and_sql()
         rule_groups = { rule(1, false, security_graph({ sql_injection = true })) },
         bindings = { binding("sec-site", { 1 }) },
     })
+    reset_request("sec-site", nil, "/")
+    ngx.req.get_headers = function()
+        return { Accept = "*/*" }
+    end
+    decision, err = runtime.debug_execute_graph(runtime.debug_active_rules("sec-site")[1].graph)
+    assert_equal(err, nil, "accept header execute err")
+    assert_equal(decision and decision.kind or "nil", "allow", "Accept */* must not trip SQL")
+
     reset_request("sec-site", nil, "/")
     ngx.var.args = "q=1'+union+select+1--"
     ngx.req.get_uri_args = function()