title: What pattern to check on an SQL query for possible injection?
body: <p>I want to detect possible SQL injection atack by checking the SQL query. I am using PDO and prepared statement, so hopefully I am not in the danger of getting attacked by someone. However, what I want to detect is the possibility of input/resulting query string that may become a dangerous query. For example, my app--properly--will never generate "1=1" query, so I may check the generated query string for that, and flag the user/IP producing that query. Same thing with "drop table", but maybe I can check only by looping the input array; or maybe I should just check to the generated query all over again. I am using MySQL, but pattern for other drivers are also appreciated.</p>
  
  <p>I have read <a href="https://stackoverflow.com/questions/45093/regex-to-detect-sql-injection">RegEx to Detect SQL Injection</a> and some of the comments are heading in this direction. To my help, I'm developing for users that rarely use English as input, so a simple /drop/ match on the query may be enough to log the user/query for further inspection. Some of the pattern I found while researching SQL injection are:</p>
  
  <ul>
  <li>semicolon in the middle of sentence -- although this may be common</li>
  <li>double dash/pound sign for commenting the rest of the query</li>
  <li>using quote in the beginning &amp; ending of value</li>
  <li>using hex (my target users have small to low chance for inputting 0x in their  form)</li>
  <li>declare/exec/drop/1=1 (my app should not generate these values)</li>
  <li>html tag (low probability coming from intended user/use case)</li>
  <li>etc.</li>
  </ul>
  
  <p>All of the above are easier to detect by looping the input values before the query string is generated because they haven't been escaped. But how much did I miss? (a lot, I guess) Any other obscure pattern I should check? What about checking the generated query? Any pattern that may emerge?</p>
  
  <p>tl;dr: What pattern to match an SQL query (MySQL) to check for possible injection? I am using PDO with prepared statement and value binding, so the check is for logging/alert purposes.</p>