Surely if you've resorted to blocking random SQL keywords you've already lost. SQL has a pretty big dialect not to mention arbitrary functions and procedures that might exist.
For instance, TRUNCATE isn't even in the list
For instance, TRUNCATE isn't even in the list
At a previous job the IT set up a spam filter which used a keyword list (dumb attempt anyway), but it also searched the email headers (not only the body). As a result, we weren't able to receive email if one of the SMTP hops was named, say, smtp.essex.company.com.
And so they will block requests containing DROP etc even if the systems they are fronting are perfect.