1. A computer-implemented method, comprising: receiving a statement that contains an application input string that references a function which, when executed, stores a particular value; and wherein the application input string comprises a string literal specified by a user of an application, followed by a concatenation symbol, followed by the function; sending the statement to a database server for execution; wherein the presence of the stored particular value indicates that the database server invoked the function; wherein the invocation of the function indicates that the application is vulnerable to Structured Query Language (SQL) injection attack; wherein the method is performed by one or more computing devices.