diff --git a/src/middleware.py b/src/middleware.py
index c909983..3127020 100644
--- a/src/middleware.py
+++ b/src/middleware.py
@@ -20,8 +20,11 @@ MAX_JSON_BODY_SIZE = 1024 * 100  # 100 KB
 
 # Very targeted patterns. Avoid catastrophic regex nonsense.
 XSS_PATTERN_STR = r"(<script|</script|javascript:|onerror\s*=|onload\s*=|<svg|<img)"
+XSS_PATTERN = re.compile(XSS_PATTERN_STR, re.IGNORECASE)
 
 SQLI_PATTERN_STR = r"(\bUNION\b|\bSELECT\b|\bINSERT\b|\bDELETE\b|\bDROP\b|--|\bOR\b\s+1=1)"
+SQLI_PATTERN = re.compile(SQLI_PATTERN_STR, re.IGNORECASE)
+
 
 # JSON prototype pollution keys
 FORBIDDEN_JSON_KEYS = {"__proto__", "constructor", "prototype"}