They might if the programmer didn't have the sense to surround the keywords with word boundary markers. You know, something like %20SET%20 etc. I do this successfully with mod_security, and a good regex kit will let you do this easily.