How do I judge whether a given sql statement has sql injection risk or not
Analysis the sql comes from sql log only, trying to find out which sql statement has risk of sql injection.

By the time the SQL reaches your database, it's probably too late to tell.
By the time the SQL reaches the sql log (having been executed), it's definitely too late!
If you see lots of placeholders ('?' or ':name'), then your SQL is using Prepared Statements and, therefore, is probably safe from SQL Injection.
If you see lots of literal values, your database has no way of knowing how they got there.
For example, both of the following would reach you looking exactly the same but, as you can clearly see, one is clearly vulnerable.
$sql = &quot;update table1 set name = 'fred' where id = 76543 &quot;;

$name = $_POST['name'];
$id =   $_POST['id'];
$sql =  &quot;update table1 set name = '$name' where id = $id &quot;;

SQL Injection is an Application problem.  Plain and simple.
Point your Developers in the direction of this Accepted Answer, over on Software Engineering, particularly the Security section.