[mod-security-users] help with rule

[modsecurity <mod...@ez...>]

I'm trying to block clients from using web based scripts to send mail =
from *@paypal.com or with the realname of paypal. This is what the post =
looks like:

-----------------------------7d43991d691196
Content-Disposition: form-data; name=3D"from"

bi...@pa...
-----------------------------7d43991d691196
Content-Disposition: form-data; name=3D"realname"

paypal

Since the name=3D"from" and the bi...@pa... are not on the same =
line I'm having a little trouble with this. Can anyone give me a clue as =
to how this can be done?