Here's another take on SQL injection detection, which delves into the query language a bit more, including a formal analysis:

http://www.cs.uiuc.edu/~madhu/tissec09.pdf