Here's another take on SQL injection detection, which delves into the query language a bit more, including a formal analysis: http://www.cs.uiuc.edu/~madhu/tis

Here's another take on SQL injection detection, which delves into the query language a bit more, including a formal analysis: http://www.cs.uiuc.edu/~madhu/tissec09.pdf http://www.cs.uiuc.edu/~madhu/tissec09.pdf