Check if there is SQL injection in a string without access to the database (no parameters)

Question

I have a task to check and prove if there is a way to prevent SQL Injection without access to the database first - So no parameterized statements. This basically means:

Is there a way to parse SQL statement as a string using any kind of tool or framework that would prove that SQL has been injected into it.

Any techniques available.

At first I had an idea to check if SQL matches a certain pattern like this:

Let somewhere be any kind of string that user can type in. This is my SQL:

SELECT Id FROM somewhere

This statement has a pattern that looks like this:

SELECT SOME_VALUE FROM SOME_TABLE

Then let's say user wrote someTable WHERE 1=1; into the somewhere variable - (I know its not the smartest of SQL Injections)

But the point is now I have a statement that looks like this:

SELECT Id FROM someTable WHERE 1=1;

Which effectively gives us a statement that has a pattern like this:

SELECT SOME_VALUE FROM SOME_TABLE WHERE SOME_CONDITION

Which does not match the initial pattern:

SELECT SOME_VALUE FROM SOME_TABLE

Is that a correct way to check if SQL has been injected? I haven't found any tools that actually use this technique, or any other technique than just parameters (which require connection to the database). Don't worry - I know that parameters are the way to go, this task is about having no connection to the database.

Answer 1

It would be an idea if you block certain keywords and symbols like 'WHERE', 'AND', 'OR', ';', and '='.

But this is just a naive approach and for production, you should use parameterized statements.